Distributes a software product, in California

Consumer Protection Against Computer Spyware Act, Cal. Bus. & Prof. Code §§ 22947-22947.6 · Read the law's page

• If you are not an authorized user of a computer (its owner, or a person its owner or lessee has authorized to use it, and a person authorized solely through an end user license agreement is not an authorized user), do not cause software to be copied onto the computer of a consumer in California (an individual who lives in California and uses the computer mainly for personal, family or household purposes) and use it to do any of the acts below; sections 22947.2 and 22947.3 apply where you act with actual knowledge, with conscious avoidance of actual knowledge or willfully.
• Do not use that software to modify, through intentionally deceptive means, the page that appears when the user launches an Internet browser, the default provider or Web proxy the user relies on to access or search the Internet, or the user's list of bookmarks.
• Do not use that software to collect, through intentionally deceptive means, personally identifiable information through a keystroke-logging function that records all of the user's keystrokes and transfers them to another person, or information covering all or substantially all of the Web sites the user visits (other than your own) where the software was installed in a manner designed to conceal the installation from every authorized user, or a financial account number, a password or PIN for a financial account, a Social Security number, or account balances or overdraft history in a form that identifies the user, extracted from the hard drive for a purpose wholly unrelated to any purpose of the software or service you described to the user.
• Without the user's authorization and through intentionally deceptive means, do not prevent the user's reasonable efforts to block or disable software by causing software the user has properly removed or disabled to reinstall or reactivate itself; do not misrepresent, knowing it to be untrue, that software will be uninstalled or disabled by the user's action; and do not use intentionally deceptive means to remove, disable or render inoperative security, antispyware or antivirus software on the computer.
• Do not use that software to take control of the computer by sending or relaying commercial electronic mail or a computer virus that someone other than the user initiated without the user's authorization, by using the user's modem or Internet service to damage the computer or to make the user incur charges the user did not authorize, by using the computer as part of a group of computers to damage another computer (including a denial of service attack), or by opening multiple, sequential, stand-alone advertisements in the user's browser when you know a reasonable user cannot close them without turning off the computer or closing the browser.
• Do not use that software to modify the user's security or other settings that protect information about the user for the purpose of stealing the user's personal information, or the computer's security settings for the purpose of damaging one or more computers.
• Without the user's authorization, do not prevent the user's reasonable efforts to block the installation of software or to disable it by presenting an option to decline installation when you know the installation will proceed anyway when the user selects it, or by falsely representing that software has been disabled.
• Do not induce a user to install a software component by intentionally misrepresenting that installing software is necessary for security or privacy reasons or in order to open, view or play a particular type of content, and do not deceptively cause a software component to be copied onto and executed on the computer with the intent that the user use it in a way that violates section 22947.4.
• Sections 22947.3 and 22947.4 leave out monitoring of or interaction with a subscriber's Internet or other network connection or service, or a protected computer, by a telecommunications carrier, cable operator, computer hardware or software provider, or provider of information service or interactive computer service for network or computer security, diagnostics, technical support, repair, authorized updates of software or system firmware, authorized remote system management, or detection or prevention of the unauthorized use of or fraudulent or other illegal activities in connection with a network, service, or computer software, including scanning for and removing software the chapter proscribes.

Cal. Civ. Code section 1798.81.5, as amended by AB 825 (2021, Ch. 527) · Read the law's page

• This binds a business that owns, licenses, or maintains personal information about a California resident, and by contract extends the same duty to a nonaffiliated third party the business discloses that information to; it exempts a health care provider, plan, or contractor already regulated by the Confidentiality of Medical Information Act, a financial institution subject to the California Financial Information Privacy Act, a covered entity governed by the federal HIPAA medical privacy and security rules, and a business already subject to state or federal law providing greater protection on the same subject, deemed compliant with this duty instead.
• Implement and maintain reasonable security procedures and practices appropriate to the nature of the personal information you own, license, or maintain, to protect it from unauthorized access, destruction, use, modification, or disclosure.
• Covered personal information reaches a name paired with a Social Security, driver's license, state ID, passport, military ID, or tax ID number, a financial account or payment card number with its access code, medical or health insurance information, unique biometric data used to authenticate a person, or genetic data, when either the name or the data element is not encrypted or redacted; it also reaches a username or email address paired with a password or security question that unlocks an online account.
• A customer injured by a violation of this duty may bring a civil action for damages under Civil Code section 1798.84(b); where the violation is a breach of nonencrypted or nonredacted personal information, the CCPA/CPRA's own statutory-damages private right of action, Civil Code section 1798.150, is a separate and further remedy, researched as this jurisdiction's privacy row.

Cal. Civ. Code sections 1798.91.04-1798.91.06 (Title 1.81.26, added by Stats. 2018, Ch. 860 (AB 1906) and Ch. 886 (SB 327); sections 1798.91.04 and 1798.91.05 amended by Stats. 2022, Ch. 785 (AB 2392)) · Read the law's page

• This binds a manufacturer of a physical connected device, a device or other physical object capable of connecting to the internet, directly or indirectly, and assigned an internet protocol or Bluetooth address, that is sold or offered for sale in California; it does not by itself reach a developer who publishes only an app or other software with no connected device of its own, and it does not reach unaffiliated third-party software or apps a user chooses to add to someone else's device.
• Equip the device with a security feature or features appropriate to its nature, function, and the information it may collect, contain, or transmit, designed to protect the device and that information from unauthorized access, destruction, use, modification, or disclosure.
• Where the device is equipped with a means of authentication outside a local area network, a preprogrammed password unique to each device manufactured, or a feature requiring the user to generate a new means of authentication before first access, is deemed a reasonable security feature, subject to all of the requirements of the general duty. A manufacturer may instead elect to satisfy the duty by ensuring the device meets or exceeds the baseline product criteria of a NIST-conforming labeling scheme, satisfies a conformity assessment under that scheme that includes a third-party test, inspection, or certification, and bears the scheme's binary label.
• The duty does not apply to a connected device already subject to security requirements under federal law, regulation, or federal agency guidance, or to an activity already regulated by HIPAA or California's Confidentiality of Medical Information Act.
• There is no private right of action for a violation; only the Attorney General, a city attorney, a county counsel, or a district attorney may enforce this title.

AB 316 (Ch. 672, Stats. 2025), Cal. Civ. Code Section 1714.46 · Read the law's page

• Do not defend a claim that artificial intelligence you developed, modified, or used caused harm to the plaintiff by arguing that the artificial intelligence autonomously caused the harm; the defense is unavailable (Civil Code Section 1714.46(b)).
• You may still present any other affirmative defense, including evidence relevant to causation or foreseeability, and evidence relevant to the comparative fault of any other person or entity (Section 1714.46(c)).

AB 2561 (Ch. 478, Stats. 2026), Cal. Bus. and Prof. Code Sections 22710 and 22711 · Read the law's page

• If you provide an operating system, or an application that collects, processes or stores personal information about a user in California and offers privacy settings, do not undo a user's affirmative configuration of a privacy setting without the user's consent, except as required by state or federal law, court order, or in response to a subpoena in an individual case or proceeding (Business and Professions Code Section 22711(a)).
• When you discontinue a service or application, stop collecting, using, retaining or sharing a user's personal information, or stop offering privacy options, make sure the change either complies with Section 22711(a) or maintains the current protections or increases privacy protection by reducing collection, use, sharing or retention (Section 22711(b)).

Cal. Civ. Code section 1798.136 · Read the law's page

• This duty is enacted and binds from January 1, 2027. If you develop or maintain a browser, include functionality a consumer can configure that lets the browser send an opt-out preference signal to the businesses the consumer interacts with through it (section 1798.136(a)(1)).
• Make that functionality easy for a reasonable person to locate and configure (section 1798.136(a)(2)).
• Make clear to a consumer in your public disclosures how the opt-out preference signal works and what effect it is intended to have (section 1798.136(b)).

SB 867 (Ch. 189, Stats. 2026), Cal. Bus. and Prof. Code Section 22604.5 · Read the law's page

• If you manufacture, sell or exchange toys, possess toys with intent to sell or exchange them, or offer toys to a retailer, do not include a companion chatbot in a toy, meaning a physical product designed, marketed, or manufactured for use in play by children under 16 years of age (Section 22604.5(a)).
• Do not supply a toy that includes an artificial intelligence system with a natural language interface that gives adaptive, human-like responses to user inputs and can sustain a relationship across multiple interactions, other than a bot limited to customer service or similar business purposes, a limited video game bot or a stand-alone voice-command speaker (Sections 22601(b), 22604.5(a)).