Law / United States / 
California
Reader Privacy Act
Officially Reader Privacy Act
Cal. Civ. Code sections 1798.90 and 1798.90.05
In force since .
A sensitive categories rule binding private bodies.
- Obligation class
- Prohibition, Retention, Disclosure
- Audit expectation
- none
As of .
What it requires
- If you are a commercial entity offering a book service to the public, meaning a service whose primary purpose is the rental, purchase, borrowing, browsing or viewing of books in print, audio, electronic or other format, do not knowingly disclose a user's personal information to a government entity, and do not disclose it to anyone under compulsion, except as the section allows. A store that sells a variety of consumer products is outside the section when its book sales are no more than 2 percent of its total annual gross sales of consumer products sold in the United States.
- Disclose a user's personal information to a law enforcement entity only under a court order from a court with jurisdiction over the offense under investigation, issued on findings of probable cause, a compelling interest and no less intrusive means, after reasonable notice to you of the proceeding and with the law enforcement entity's statement that it has notified the user, unless a judge has found a strong showing of necessity to delay that notice for up to 90 days.
- Disclose a user's personal information to another government entity, or to a person or private entity in a pending action, only under a court order issued on findings of a compelling interest and no less intrusive means, after reasonable notice to you, and refrain from disclosing until you have given the user notice of the order and the user has had at least 35 days to appear and quash it.
- You may disclose a user's personal information where the user has given informed, affirmative consent to the specific disclosure for a particular purpose; to a government entity on a good-faith belief in imminent danger of death or serious physical injury that needs immediate disclosure; and to a government entity where you believe in good faith the information is evidence directly related and relevant to a crime against you or that user.
- On a law enforcement entity's request, preserve the records of a user's personal information related to the use of a book or part of a book for 90 days, and for a further 90 days on a renewed request.
- If you have disclosed personal information of more than 30 total users located in California or of unknown location, prepare an annual report, covering the previous calendar year, of the warrants, subpoenas, court orders and consent requests you received, the emergency and crime-against-you disclosures you made, and for each category the notices given, disclosures made and not made, contests, users affected and types of information disclosed.
- Make the report publicly available in an online, searchable format on or before March 1 each year, or post it prominently on your premises or send it to the Office of Privacy Protection by that date if you have no website. If you are subject to Business and Professions Code section 22575, also link to or post the report in your privacy policy or site by March 1, or state there that no report is available because you are exempt.
These lines are LexLint's reading of the law's text, as of .
If you get it wrong
Criminal exposureNo
Private right of actionYes
Penalty structure
Section 1798.90(g)(1)(B): a provider that knowingly provides personal information about a user to a government entity in violation of the section is subject, in addition to the user's civil penalty, to a civil penalty not to exceed $500 for each violation, recoverable in an action by the Attorney General, a district attorney or city attorney, or a city prosecutor in a city with a full-time city prosecutor. The figure is a ceiling.
- Rule
- Per violation only
- As of
- Currency
- USD
- Per violation unit
- Violation
- Per violation amount
- 500
Statutory damages
Section 1798.90(g)(1)(A): a provider that knowingly provides personal information about a user to a government entity in violation of the section is subject to a civil penalty not to exceed $500 for each violation, paid to the user in a civil action brought by the user. The figure is a ceiling. The penalties are not the exclusive remedy under section 1798.90(g)(3).
- As of
Who enforces it
Enforcement body
A user sues in their own name under Civil Code section 1798.90(g)(1)(A). The Attorney General, any district attorney or city attorney, and a city prosecutor in a city with a full-time city prosecutor may bring a civil action under section 1798.90(g)(1)(B).
Settledness
- As of
- Open questions
- Does a subscription service for audiobooks, e-books and periodicals have "as its primary purpose" the "viewing of books" under section 1798.90(b)(2) when serial publications, which section 1798.90(b)(1) excludes from "book", make up part of its catalog?
- Does the exclusion in section 1798.90(b)(2) for a store whose book service sales do not exceed "2 percent of the store's total annual gross sales of consumer products sold in the United States" reach an online marketplace whose primary purpose is not books?
What this law does
Bars a provider of a book service from knowingly disclosing a user's personal information to a government entity, or being compelled to disclose it to anyone, except in the circumstances the section lists. A book service is a service whose primary purpose is the rental, purchase, borrowing, browsing, or viewing of books.
A store that sells a variety of consumer products is not a book service when its book service sales do not exceed 2 percent of its total annual gross sales of consumer products sold in the United States. A provider is any commercial entity offering a book service to the public. A book is paginated or similarly organized content in printed, audio, electronic, or other format, and does not include serial publications such as a magazine or newspaper.
Personal information includes any information that identifies, relates to, describes, or is associated with a particular user, a unique identifier or Internet Protocol address used to identify a user or book, and information relating to a user's access to or use of a book service or book.
A provider may disclose to a law enforcement entity only under a court order from a court with jurisdiction over the offense under investigation, issued on findings of probable cause, a compelling interest and no less intrusive means. Before the order issues, the law enforcement entity must give the provider reasonable notice of the proceeding and tell the provider it has notified the user, unless a judge finds a strong showing of necessity to delay notice for up to 90 days.
Before complying with a court order sought by another government entity or a private party, the provider must give the user notice of the order and at least 35 days to appear and quash it. Disclosure is permitted where the user has given informed, affirmative consent to the specific disclosure for a particular purpose.
A provider may disclose to a government entity on a good-faith belief in imminent danger of death or serious physical injury that requires immediate disclosure, and the government entity must give a written statement of the facts on request or within 48 hours after seeking disclosure. A provider may disclose to a government entity where it believes in good faith that the information is evidence directly related and relevant to a crime against the provider or that user.
On a law enforcement entity's request a provider must preserve records of a user's personal information for 90 days, extended by another 90 days on a renewed request. No evidence obtained in violation of the section is admissible in any civil or administrative proceeding, except in an action for a violation of the section.
A provider that has disclosed personal information of more than 30 total users must prepare an annual report of the demands it received and the disclosures it made in the previous calendar year. Reports must be made publicly available in an online, searchable format on or before March 1 of each year. A provider subject to section 22575 of the Business and Professions Code must, by March 1, link to or post its latest report, or state that none is available because it is exempt.
A provider that knowingly provides a user's personal information to a government entity in violation of the section is subject to a civil penalty not to exceed $500 per violation, paid to the user in a civil action brought by the user. The Attorney General, a district attorney or city attorney, or a city prosecutor in a city with a full-time city prosecutor may recover a further civil penalty not to exceed $500 per violation.
A civil action must be commenced within two years after the claimant first discovered the violation. Objectively reasonable reliance on a warrant, a court order, or an enumerated exception is a complete defense to a civil action.
The section does not make it unlawful for a law enforcement entity to obtain a search warrant for a user's personal information when probable cause exists to believe the person possessing it has committed an offense involving child pornography or the sexual exploitation of children.
When LexLint raises it
When your app profile says your app ships a mobile app or tracks devices.