Ships a mobile app, in California

Cal. Bus. and Prof. Code sections 22575 to 22579 · Read the law's page

• Conspicuously post a privacy policy if your commercial website or online service collects personally identifiable information (a name, address, email address, phone number, Social Security number or other identifier that permits contacting a person) online from California residents who use it: put the policy on the homepage or first significant page, or link to it there so a reasonable person would notice (for example a text link containing the word "privacy"). For an online service, which the Attorney General reads to include a mobile app, any other reasonably accessible means works.
• List in the policy the categories of personally identifiable information you collect and the categories of third parties you may share it with.
• Describe in the policy any process you maintain for a user to review and request changes to their information, how you notify users of material changes to the policy, and the policy's effective date.
• Disclose in the policy whether other parties may collect information about a user's online activities over time and across different sites when someone uses your service. If you collect that information yourself, also disclose how you respond to browser Do Not Track signals or similar choice mechanisms, or link to a description of the choice program you follow.
• Follow your own posted privacy policy: a knowing and willful, or negligent and material, failure to comply with it is a violation.
• Post a missing privacy policy within 30 days of being notified that it is missing.

Cal. Civ. Code sections 1798.90 and 1798.90.05 · Read the law's page

• If you are a commercial entity offering a book service to the public, meaning a service whose primary purpose is the rental, purchase, borrowing, browsing or viewing of books in print, audio, electronic or other format, do not knowingly disclose a user's personal information to a government entity, and do not disclose it to anyone under compulsion, except as the section allows. A store that sells a variety of consumer products is outside the section when its book sales are no more than 2 percent of its total annual gross sales of consumer products sold in the United States.
• Disclose a user's personal information to a law enforcement entity only under a court order from a court with jurisdiction over the offense under investigation, issued on findings of probable cause, a compelling interest and no less intrusive means, after reasonable notice to you of the proceeding and with the law enforcement entity's statement that it has notified the user, unless a judge has found a strong showing of necessity to delay that notice for up to 90 days.
• Disclose a user's personal information to another government entity, or to a person or private entity in a pending action, only under a court order issued on findings of a compelling interest and no less intrusive means, after reasonable notice to you, and refrain from disclosing until you have given the user notice of the order and the user has had at least 35 days to appear and quash it.
• You may disclose a user's personal information where the user has given informed, affirmative consent to the specific disclosure for a particular purpose; to a government entity on a good-faith belief in imminent danger of death or serious physical injury that needs immediate disclosure; and to a government entity where you believe in good faith the information is evidence directly related and relevant to a crime against you or that user.
• On a law enforcement entity's request, preserve the records of a user's personal information related to the use of a book or part of a book for 90 days, and for a further 90 days on a renewed request.
• If you have disclosed personal information of more than 30 total users located in California or of unknown location, prepare an annual report, covering the previous calendar year, of the warrants, subpoenas, court orders and consent requests you received, the emergency and crime-against-you disclosures you made, and for each category the notices given, disclosures made and not made, contests, users affected and types of information disclosed.
• Make the report publicly available in an online, searchable format on or before March 1 each year, or post it prominently on your premises or send it to the Office of Privacy Protection by that date if you have no website. If you are subject to Business and Professions Code section 22575, also link to or post the report in your privacy policy or site by March 1, or state there that no report is available because you are exempt.

Cal. Civ. Code section 1798.81.5, as amended by AB 825 (2021, Ch. 527) · Read the law's page

• This binds a business that owns, licenses, or maintains personal information about a California resident, and by contract extends the same duty to a nonaffiliated third party the business discloses that information to; it exempts a health care provider, plan, or contractor already regulated by the Confidentiality of Medical Information Act, a financial institution subject to the California Financial Information Privacy Act, a covered entity governed by the federal HIPAA medical privacy and security rules, and a business already subject to state or federal law providing greater protection on the same subject, deemed compliant with this duty instead.
• Implement and maintain reasonable security procedures and practices appropriate to the nature of the personal information you own, license, or maintain, to protect it from unauthorized access, destruction, use, modification, or disclosure.
• Covered personal information reaches a name paired with a Social Security, driver's license, state ID, passport, military ID, or tax ID number, a financial account or payment card number with its access code, medical or health insurance information, unique biometric data used to authenticate a person, or genetic data, when either the name or the data element is not encrypted or redacted; it also reaches a username or email address paired with a password or security question that unlocks an online account.
• A customer injured by a violation of this duty may bring a civil action for damages under Civil Code section 1798.84(b); where the violation is a breach of nonencrypted or nonredacted personal information, the CCPA/CPRA's own statutory-damages private right of action, Civil Code section 1798.150, is a separate and further remedy, researched as this jurisdiction's privacy row.

Cal. Code Regs. tit. 11, sections 7010 to 7016 · Read the law's page

• Provide a privacy policy that describes your online and offline information practices and your consumers' rights, make it available in a format a consumer can print, and post it online through a conspicuous link using the word privacy on your website homepage or on your mobile application's download or landing page (sections 7010(a) and 7011).
• If you offer a mobile application, include a link to the privacy policy in the application's settings menu (section 7011(d)).
• If you control the collection of a consumer's personal information, give a notice at collection where consumers will encounter it at or before the point of collection, whether online, in an application or offline (sections 7010(b) and 7012).
• If you sell or share personal information, provide a notice of right to opt out of sale or sharing, or the alternative opt-out link (sections 7010(e), 7013 and 7015).
• If you use or disclose sensitive personal information for purposes beyond those listed in section 7027(m), provide a notice of right to limit or the alternative opt-out link (sections 7010(f) and 7014).
• If you offer a financial incentive or a price or service difference, provide a notice of financial incentive (sections 7010(g) and 7016).

2026 Cal. Stats. ch. 184 (AB 1856), amending Cal. Civ. Code §§ 1798.500-1798.504 · Read the law's page

• Applies to any operating system that operates on a device and has an account setup feature, and to the application developers and covered application stores already reached by the Digital Age Assurance Act; browsers and website operators are not covered.
• As an operating system provider, send the age signal to a covered application store or to an application developer.
• As a developer, request a signal when an application is downloaded and launched, treat the signal as the primary indicator of a user's age absent clear and convincing contrary information, and do not request more information than the minimum needed.
• Do not request a signal unless this title or other applicable law requires it.
• For a device or application already set up or downloaded before January 1, 2027, request or provide the signal by July 1, 2027.
• As an operating system provider or application store, do not use compliance data anticompetitively (a nondiscrimination duty).

AB 2561 (Ch. 478, Stats. 2026), Cal. Bus. and Prof. Code Sections 22710 and 22711 · Read the law's page

• If you provide an operating system, or an application that collects, processes or stores personal information about a user in California and offers privacy settings, do not undo a user's affirmative configuration of a privacy setting without the user's consent, except as required by state or federal law, court order, or in response to a subpoena in an individual case or proceeding (Business and Professions Code Section 22711(a)).
• When you discontinue a service or application, stop collecting, using, retaining or sharing a user's personal information, or stop offering privacy options, make sure the change either complies with Section 22711(a) or maintains the current protections or increases privacy protection by reducing collection, use, sharing or retention (Section 22711(b)).