Bill Text: CA AB1262 | 2021-2022 | Regular Session | Enrolled
Bill Title: Information privacy: other connected device with a voice recognition feature.
Spectrum: Bipartisan Bill
Status: (Vetoed) 2022-09-29 - Vetoed by Governor. [AB1262 Detail]
Download: California-2021-AB1262-Enrolled.html
|
Enrolled
September 02, 2022 |
|
Passed
IN
Senate
August 31, 2022 |
|
Passed
IN
Assembly
August 31, 2022 |
|
Amended
IN
Senate
August 25, 2022 |
|
Amended
IN
Senate
August 01, 2022 |
|
Amended
IN
Senate
January 03, 2022 |
|
Amended
IN
Senate
June 29, 2021 |
CALIFORNIA LEGISLATURE—
2021–2022 REGULAR SESSION
Assembly Bill
No. 1262
| Introduced by Assembly Member Cunningham (Coauthor: Assembly Member Wicks) |
February 19, 2021 |
An act to amend Section 22948.20 of, to amend, add, and repeal Sections 22948.21 and 22948.23 of, to amend the heading of Chapter 35 (commencing with Section 22948.20) of Division 8 of, and to add Section 22948.20.1 to, the Business and Professions Code, relating to information privacy.
LEGISLATIVE COUNSEL'S DIGEST
AB 1262, Cunningham.
Information privacy: other connected device with a voice recognition feature.
Existing law prohibits a person or entity from providing the operation of a voice recognition feature of a connected television within the state without prominently informing the specified user of the connected television during the initial setup or installation. Existing law prohibits any actual recordings of spoken word collected for a specified purpose through the operation of a voice recognition feature by the manufacturer of a connected television, or a contracting third party, from being sold or used for any advertising purpose. Existing law prohibits a person or entity from compelling a manufacturer or other entity providing the operation of a voice recognition feature to build specific features for the purpose of allowing an investigative or law enforcement officer to monitor communications through that feature.
Existing law limits the
liability of a manufacturer to functionality provided at the time of the original sale of a connected television and specifically excludes liability for functionality provided by applications the user chooses to use in the cloud or that are downloaded and installed by a user. Existing law prohibits a waiver of these prohibitions and authorizes their enforcement by injunction or civil penalty in a court of competent jurisdiction by the Attorney General or a district attorney. Existing law defines terms for these purposes.
This bill, beginning on January 1, 2024, would include smart speaker devices, as defined, within the scope of those provisions. The bill would prohibit any actual recordings or transcriptions collected or retained through the operation of a voice recognition feature by the manufacturer of a smart speaker device, that qualify as personal
information or that are not deidentified, from being retained electronically or shared with, or sold to, a third party, unless the user has provided affirmative consent, as defined and specified, or the information is shared or retained for certain limited purposes. The bill would also prohibit the use of recordings made from an incorrect activation of the device, except as specified. The bill would also prohibit the manufacturer of a smart speaker device from retaining the recordings or transcripts, as specified, unless the user opts in. The bill would provide certain exemptions and would define related terms.
Existing law, an initiative measure that will take effect January 1, 2023, includes a definition of “consent” pertaining to consumer privacy.
This bill would expressly incorporate the initiative measure’s
definition of consent into the definition of affirmative consent for the purposes of these provisions.
Digest Key
Vote: MAJORITY Appropriation: NO Fiscal Committee: YES Local Program: NOBill Text
The people of the State of California do enact as follows:
SECTION 1.
It is the intent of the Legislature that this act shall not be construed to limit consumer privacy protection required pursuant to the California Consumer Privacy Act of 2018 (Title 1.81.5 (commencing with Section 1798.100) of Part 4 of Division 3 of the Civil Code).SEC. 2.
The heading of Chapter 35 (commencing with Section 22948.20) of Division 8 of the Business and Professions Code is amended to read:CHAPTER 35. Connected Televisions and Devices
SEC. 3.
Section 22948.20 of the Business and Professions Code is amended to read:22948.20.
(a) A person or entity shall not provide the operation of a voice recognition feature within this state without prominently informing, during the initial setup or installation of a connected television, either the user or the person designated by the user to perform the initial setup or installation of the connected television.(b) Any actual recordings of spoken word collected through the operation of a voice recognition feature by the manufacturer of a connected television for the purpose of improving the voice recognition feature, including, but not limited to, the operation of an accessible user interface for people with disabilities, shall not be sold or used for any advertising purpose.
(c) Any actual recordings of spoken word collected through the operation of a voice recognition feature by a third party contracting with a manufacturer of a connected television for the purpose of improving the voice recognition feature, including, but not limited to, the operation of an accessible user interface for people with disabilities, shall not be shared, sold, or used for any advertising purpose.
(d) A person or entity shall not compel a manufacturer of a connected television or
other entity providing the operation of a voice recognition feature by a manufacturer of a connected television to build specific features for the purpose of allowing an investigative or law enforcement officer to monitor communications through that feature.
(e) A manufacturer of a connected television shall only be liable for functionality provided at the time of the original sale of a connected television and shall not be liable for functionality provided by applications that the user chooses to use in the cloud or are downloaded and installed by a user.
(f) This chapter shall not apply to any product or service provided by a company covered under Section 637.5 of
the Penal Code.
SEC. 4.
Section 22948.20.1 is added to the Business and Professions Code, to read:22948.20.1.
(a) A manufacturer of a smart speaker device shall not provide the operation of a voice recognition feature within this state without prominently informing, during the initial setup or installation of a smart speaker device, either the user or the person designated by the user to perform the initial setup or installation of a smart speaker device of both of the following:(1) That the smart speaker device contains a voice recognition feature.
(2) What actions or commands will activate the voice recognition feature to record or transcribe audio.
(b) A recording or transcription collected or retained through the
operation of a voice recognition feature by the manufacturer of a smart speaker device, including, but not limited to, the operation of an accessible user interface for people with disabilities, if the recording or transcription qualifies as personal information or is not deidentified, shall not be:
(1) Shared with, or sold to, a third party, unless the user has provided affirmative consent.
(2) Retained electronically, unless the user provides affirmative consent to having that recording retained by the manufacturer of a smart speaker device either during installation or at a later time in the device settings.
(c) Notwithstanding subdivision (b), a manufacturer of a smart speaker device may share information with a third party or retain information without affirmative consent to the extent sharing or retaining that
information is necessary to execute a function or provide a service requested by the user, provided the manufacturer of a smart speaker device does not use that information for any purpose other than to facilitate the execution of that function or provision of that service.
(d) If a user has provided affirmative consent for the sharing or sale of a recording or transcription as provided in paragraph (1) of subdivision (b), the manufacturer of a smart speaker device shall provide the user with the option to revoke that consent at any time in a manner reasonably accessible to the user.
(e) If a user has declined to provide affirmative consent for the sharing or sale of a recording or transcription as provided in paragraph (1) of subdivision (b), the person or entity seeking consent shall not request that affirmative consent for a period of at least one month after the user has
declined to provide that affirmative consent, or when the user attempts to access a function that requires affirmative consent.
(f) If a person or entity providing the operation of a smart speaker device with a voice recognition feature within this state retains voice recordings that qualify as personal information or are not deidentified, that person or entity shall provide users with both of the following:
(1) An interface to review and delete those voice recordings. The interface shall be easily accessible and the user’s rights provided by this chapter with respect to these recordings shall be clearly communicated to the user.
(2) The ability to delete those voice recordings automatically.
(g) (1) If a person or entity providing
the operation of a smart speaker device with a voice recognition feature that can be activated by a voice command determines that the voice recognition feature was incorrectly activated, the person or entity shall not use the associated audio recording for any purpose, except as specified in paragraph (2), and may retain only the initial portion of that audio recording reasonably necessary for those purposes, not to exceed 15 seconds of duration.
(2) A person or entity providing the operation of a smart speaker device with a voice recognition feature that can be activated by a voice command may use an audio recording associated with an incorrect activation of a voice recognition feature to improve the functioning of the voice recognition feature or to comply with subdivision (f).
(h) A person or entity shall not compel a manufacturer of a smart speaker device or other entity
providing the operation of a smart speaker device with a voice recognition feature to build specific features for the purpose of allowing an investigative or law enforcement officer to monitor communications through that feature.
(i) A manufacturer of a smart speaker device shall not be liable for functionality provided by applications that the user chooses to use in the cloud or are downloaded and installed by a user, unless the manufacturer of a smart speaker device collects, controls, or has access to any personal information collected or elicited by the applications.
(j) This chapter shall not apply to any product or service provided by a company covered under Section 637.5 of the Penal Code.
(k) This chapter shall not apply to a product or service used for the purpose of recording information described in
subdivision (c) of Section 1798.145 of the Civil Code.
(l) This chapter shall not apply to any device regulated by the United States Food and Drug Administration.
(m) This section shall become operative on January 1, 2024.
SEC. 5.
Section 22948.21 of the Business and Professions Code is amended to read:22948.21.
For purposes of this chapter, the following definitions shall apply:(a) “Affirmative consent” means that a manufacturer of a connected television or smart speaker device has done all of the following:
(1) Clearly and conspicuously disclosed to the user, separate from the device terms of use, all of the following to the extent applicable:
(A) The device may be used to process and retain user recordings.
(B) The recordings described in subparagraph (A) may be analyzed or shared with third parties.
(C) The device may be used to process and retain transcriptions of spoken words.
(D) The transcriptions described in subparagraph (C) may be analyzed or shared with third parties.
(2) Clearly and conspicuously disclosed to the user, separate from the device terms of use, the extent to which the device can operate in the absence of consent for each practice described in the disclosure required
by paragraph (1).
(3) Received consent, as defined in Section 1798.140 of the Civil Code, for each practice described in the disclosure required by paragraph (1).
(b) “Cloud computing storage service” has the same definition as the term is defined by the National Institute of Standards and Technology Special Publication 800-145, or a successor publication, and includes the service and deployment models referenced therein.
(c) “Connected television” means a video device designed for home use to receive television signals and reproduce them on an integrated, physical screen display that
exceeds 12 inches, except that this term shall not include a personal computer, portable device, or a separate device that connects physically or wirelessly to a television, including, but not limited to, a set-top box, video game console, or digital video recorder.
(d) “Deidentified” has the same meaning as set forth in Section 1798.140 of the Civil Code.
(e) “Personal information” has the same meaning as set forth in Section 1798.140 of the Civil Code.
(f) “Retained” means saving or storing, or both saving and storing, voice recorded data longer than the minimum time necessary to
complete a requested command by the user.
(g) “Sell” has the same meaning as set forth in Section 1798.140 of the Civil Code.
(h) “Share” has the same meaning as set forth in Section 1798.140 of the Civil Code.
(i) (1) “Smart speaker device” means a speaker and voice command device offered for sale in this state with an integrated virtual assistant connected to a cloud computing storage service that uses hands-free verbal activation.
(2) A smart speaker device does not include a cellular telephone, a tablet, a laptop computer with mobile data access, a pager, or a motor vehicle, as defined in Section 415 of the Vehicle Code, or any speaker or device associated with, or connected to, a vehicle.
(j) “Third party” has the same meaning as set forth in Section 1798.140 of the Civil Code.
(k) (1) “User” means a person who originally purchases, leases, or takes ownership of a connected television or smart speaker device or another person designated by the user to perform the initial setup or installation of the connected television or smart speaker
device.
(2) A person who is incidentally recorded when a voice recognition feature is activated by a user shall not be deemed to be a user.
(l) “Voice recognition feature” means the function of a connected television or smart speaker device with a voice recognition feature that allows the collection, recording, storage, analysis, transmission, interpretation, or other use of spoken words or other sounds, except that this term shall not include spoken words or other sounds that are not recorded, retained, or transmitted beyond the connected television or smart speaker device.
(m) “Voice
recorded data” means audio recordings or transcriptions of those recordings collected through the operation of a voice recognition feature by the manufacturer of a connected television or smart speaker device.
(n) This section shall become operative on January 1, 2024.
SEC. 6.
Section 22948.21 is added to the Business and Professions Code, to read:22948.21.
For purposes of this chapter, the following definitions shall apply:(a) “Connected television” means a video device designed for home use to receive television signals and reproduce them on an integrated, physical screen display that exceeds 12 inches, except that this term shall not include a personal computer, portable device, or a separate device that connects physically or wirelessly to a television, including, but not limited to, a set-top box, video game console, or digital video recorder.
(b) “User” means a person who originally purchases, leases, or takes ownership of a connected television. A person who is incidentally
recorded when a voice recognition feature is activated by a user shall not be deemed to be a user.
(c) “Voice recognition feature” means the function of a connected television that allows the collection, recording, storage, analysis, transmission, interpretation, or other use of spoken words or other sounds, except that this term shall not include voice commands that are not recorded or transmitted beyond the connected television.
(d) This section shall remain in effect only until January 1, 2024, and as of that date is repealed.
SEC. 7.
Section 22948.23 of the Business and Professions Code is amended to read:22948.23.
(a) Actions for relief pursuant to this chapter may be prosecuted exclusively in a court of competent jurisdiction in a civil action brought in the name of the people of the State of California by the Attorney General or by any district attorney. This chapter shall not be deemed to create a private right of action or limit any existing private right of action.(b) A court may enjoin a person who knowingly engages, has engaged, or proposes to engage, in a violation of this chapter. The court may make any orders or judgments as may be necessary to prevent a violation of this chapter.
(c) A person who knowingly engages, has
engaged, or proposes to engage, in a violation of this chapter shall be liable for a civil penalty not to exceed two thousand five hundred dollars ($2,500) for each connected television or smart speaker device sold or leased in violation of this chapter. If the action is brought by the Attorney General, the penalty shall be deposited into the General Fund. If the action is brought by a district attorney, the penalty shall be paid to the treasurer of the county in which the judgment was entered.
(d) This section shall become operative on January 1, 2024.
SEC. 8.
Section 22948.23 is added to the Business and Professions Code, to read:22948.23.
(a) Actions for relief pursuant to this chapter may be prosecuted exclusively in a court of competent jurisdiction in a civil action brought in the name of the people of the State of California by the Attorney General or by any district attorney. This chapter shall not be deemed to create a private right of action, or limit any existing private right of action.(b) A court may enjoin a person who knowingly engages, has engaged, or proposes to engage, in a violation of this chapter. The court may make any orders or judgments as may be necessary to prevent a violation of this chapter.
(c) A person who knowingly engages, has
engaged, or proposes to engage, in a violation of this chapter shall be liable for a civil penalty not to exceed two thousand five hundred dollars ($2,500) for each connected television sold or leased in violation of this chapter. If the action is brought by the Attorney General, the penalty shall be deposited into the General Fund. If the action is brought by a district attorney, the penalty shall be paid to the treasurer of the county in which the judgment was entered.
(d) This section shall remain in effect only until January 1, 2024, and as of that date is repealed.
