Law / United States / 
California
Consumer Protection Against Computer Spyware Act
Consumer Protection Against Computer Spyware Act, Cal. Bus. & Prof. Code §§ 22947-22947.6
In force since .
A device storage and tracking consent rule binding private bodies.
- Obligation class
- Prohibition, Consent
As of .
What it requires
- If you are not an authorized user of a computer (its owner, or a person its owner or lessee has authorized to use it, and a person authorized solely through an end user license agreement is not an authorized user), do not cause software to be copied onto the computer of a consumer in California (an individual who lives in California and uses the computer mainly for personal, family or household purposes) and use it to do any of the acts below; sections 22947.2 and 22947.3 apply where you act with actual knowledge, with conscious avoidance of actual knowledge or willfully.
- Do not use that software to modify, through intentionally deceptive means, the page that appears when the user launches an Internet browser, the default provider or Web proxy the user relies on to access or search the Internet, or the user's list of bookmarks.
- Do not use that software to collect, through intentionally deceptive means, personally identifiable information through a keystroke-logging function that records all of the user's keystrokes and transfers them to another person, or information covering all or substantially all of the Web sites the user visits (other than your own) where the software was installed in a manner designed to conceal the installation from every authorized user, or a financial account number, a password or PIN for a financial account, a Social Security number, or account balances or overdraft history in a form that identifies the user, extracted from the hard drive for a purpose wholly unrelated to any purpose of the software or service you described to the user.
- Without the user's authorization and through intentionally deceptive means, do not prevent the user's reasonable efforts to block or disable software by causing software the user has properly removed or disabled to reinstall or reactivate itself; do not misrepresent, knowing it to be untrue, that software will be uninstalled or disabled by the user's action; and do not use intentionally deceptive means to remove, disable or render inoperative security, antispyware or antivirus software on the computer.
- Do not use that software to take control of the computer by sending or relaying commercial electronic mail or a computer virus that someone other than the user initiated without the user's authorization, by using the user's modem or Internet service to damage the computer or to make the user incur charges the user did not authorize, by using the computer as part of a group of computers to damage another computer (including a denial of service attack), or by opening multiple, sequential, stand-alone advertisements in the user's browser when you know a reasonable user cannot close them without turning off the computer or closing the browser.
- Do not use that software to modify the user's security or other settings that protect information about the user for the purpose of stealing the user's personal information, or the computer's security settings for the purpose of damaging one or more computers.
- Without the user's authorization, do not prevent the user's reasonable efforts to block the installation of software or to disable it by presenting an option to decline installation when you know the installation will proceed anyway when the user selects it, or by falsely representing that software has been disabled.
- Do not induce a user to install a software component by intentionally misrepresenting that installing software is necessary for security or privacy reasons or in order to open, view or play a particular type of content, and do not deceptively cause a software component to be copied onto and executed on the computer with the intent that the user use it in a way that violates section 22947.4.
- Sections 22947.3 and 22947.4 leave out monitoring of or interaction with a subscriber's Internet or other network connection or service, or a protected computer, by a telecommunications carrier, cable operator, computer hardware or software provider, or provider of information service or interactive computer service for network or computer security, diagnostics, technical support, repair, authorized updates of software or system firmware, authorized remote system management, or detection or prevention of the unauthorized use of or fraudulent or other illegal activities in connection with a network, service, or computer software, including scanning for and removing software the chapter proscribes.
These lines are LexLint's reading of the law's text, as of .
What this law does
Section 22947.2 of the Business and Professions Code bars a person or entity that is not an authorized user, acting with actual knowledge, with conscious avoidance of actual knowledge or willfully, from causing computer software to be copied onto the computer of a consumer in California and using it to modify, through intentionally deceptive means, the page a browser opens on launch, the default provider or Web proxy, or the list of bookmarks.
The same section bars using the software to collect, through intentionally deceptive means, personally identifiable information through a keystroke-logging function or covering all or substantially all of the Web sites the user visits where the software was installed in a manner designed to conceal the installation.
It also bars using the software to prevent, through intentionally deceptive means, the user's efforts to block or disable software by making software the user removed or disabled reinstall itself, to misrepresent that software will be uninstalled or disabled, and to remove security, antispyware or antivirus software through intentionally deceptive means.
Section 22947.3 bars the same class of person on the same knowledge standard from using the software to take control of the consumer's computer by transmitting or relaying commercial electronic mail or a computer virus initiated by someone other than the authorized user and without authorization, by using the modem or Internet service to cause damage or unauthorized charges, by using the computer in a group of computers to damage another computer, or by opening multiple, sequential, stand-alone advertisements without authorization that a reasonable user cannot close without turning off the computer or closing the browser.
Section 22947.3 also bars using the software to modify the user's security or other settings for the purpose of stealing personal information, or the computer's security settings for the purpose of damaging one or more computers.
Section 22947.3 bars as well preventing, without the authorization of an authorized user, that user's efforts to block or disable software by offering an option to decline installation with knowledge that the installation will proceed anyway, or by falsely representing that software has been disabled.
Section 22947.4 separately bars a person or entity that is not an authorized user from inducing an authorized user to install a software component by intentionally misrepresenting that installing software is necessary for security or privacy reasons or in order to open, view or play a particular type of content.
An authorized user, with respect to a computer, is a person who owns it or is authorized by the owner or lessee to use it, and does not include a person or entity that obtained authorization to use the computer solely through an end user license agreement. A consumer is an individual who resides in California and uses the computer in question primarily for personal, family or household purposes.
Intentionally deceptive means by an intentionally and materially false or fraudulent statement, by a statement or description that intentionally omits or misrepresents material information in order to deceive the consumer, or by an intentional and material failure to give an authorized user any notice of the download or installation of software in order to deceive the consumer.
Section 22947.3 does not apply to monitoring of or interaction with a subscriber's Internet or other network connection or service, or a protected computer, by a telecommunications carrier, cable operator, computer hardware or software provider, or provider of information service or interactive computer service for network or computer security, diagnostics, technical support, repair, authorized updates of software or system firmware, authorized remote system management, or detection or prevention of unauthorized use or fraud.
Section 22947.4 carries the same exclusion in its subdivision (b). The chapter supersedes and preempts every local rule, ordinance and other law regarding spyware and notices to consumers from computer software providers regarding information collection. The chapter was added by Statutes 2004, chapter 843, effective .
When LexLint raises it
When your app profile says your app tracks devices or distributes a software product.