Bill Text: CA AB1355 | 2025-2026 | Regular Session | Introduced
Bill Title: Location privacy.
Spectrum: Partisan Bill (Democrat 3-0)
Status: (Introduced) 2025-02-24 - Read first time. [AB1355 Detail]
Download: California-2025-AB1355-Introduced.html
CALIFORNIA LEGISLATURE—
2025–2026 REGULAR SESSION
Assembly Bill
No. 1355
| Introduced by Assembly Member Ward (Principal coauthor: Assembly Member Aguiar-Curry) (Coauthor: Senator Wiener) |
February 21, 2025 |
An act to add Title 1.81.24 (commencing with Section 1798.90.75) to Part 4 of Division 3 of the Civil Code, relating to privacy.
LEGISLATIVE COUNSEL'S DIGEST
AB 1355, as introduced, Ward.
Location privacy.
Existing law, the California Consumer Privacy Act of 2018 (CCPA), grants a consumer various rights with respect to personal information, as defined, that is collected or sold by a business, as defined, including the right to direct a business that collects sensitive personal information about the consumer to limit its use, as prescribed. Existing law defines “sensitive personal information” to mean, among other things, personal information that reveals a consumer’s precise geolocation. Existing law, the California Privacy Rights Act of 2020, approved by the voters as Proposition 24 at the November 3, 2020, statewide general election, amended, added to, and reenacted the CCPA.
This bill would prohibit a covered entity, as defined, from collecting or using the location information of an individual unless doing so is necessary to provide goods or
services requested by that individual and the individual has expressly opted into the collection or use of their location information for that purpose. The bill would impose various other restrictions on covered entities with regard to location information. The bill would define “location information” to mean information that pertains to or directly or indirectly reveals the present or past geographical location of an individual or device, as specified.
This bill would require a covered entity to prominently display, at the point where location information is being captured, a notice to individuals stating that their location information is being collected, the name of the covered entity and service provider collecting the information, and a phone number and an internet website where the individual can obtain more information. The bill would require a covered entity to maintain and make available to the data subject a location privacy policy that includes specified
information on data usage and management and is subject to a specified notice procedure.
This bill would make a covered entity that violates these provisions liable for actual damages suffered by a person denied a right under these provisions and other specified relief. The bill would authorize the Attorney General or other public prosecutors to bring an action against a covered entity that violates these provisions.
This bill would prohibit a state or local agency from monetizing, as defined, location information. By imposing new requirements on local agencies, this bill would impose a state-mandated local program.
The California Constitution requires the state to reimburse local agencies and school districts for certain costs mandated by the state. Statutory provisions establish procedures for making that reimbursement.
This bill would provide that, if the Commission on State Mandates determines that the bill contains costs mandated by the state, reimbursement for those costs shall be made pursuant to the statutory provisions noted above.
The California Consumer Privacy Act of 2020 authorizes the Legislature to amend the act to further the purposes and intent of the act by a majority vote of both houses of the Legislature, as specified.
This bill would declare that its provisions further the purposes and intent of the California Privacy Rights Act of 2020.
Digest Key
Vote: MAJORITY Appropriation: NO Fiscal Committee: YES Local Program: YESBill Text
The people of the State of California do enact as follows:
SECTION 1.
Title 1.81.24 (commencing with Section 1798.90.75) is added to Part 4 of Division 3 of the Civil Code, to read:TITLE 1.81.24. California Location Privacy Act
1798.90.75.
(a) This title shall be known, and may be cited, as the California Location Privacy Act.(b) For purposes of this title, the following terms shall, unless the context clearly requires otherwise, have the following meanings:
(1) “Automated license plate recognition information,” or “ALPR information” means information or data collected through the use of an ALPR system.
(2) “Automated license plate recognition system” or “ALPR system” means a searchable computerized database resulting from the operation of one or more mobile or fixed cameras combined with computer algorithms to read and convert images of
registration plates and the characters they contain into computer-readable data.
(3) “Collect” means to obtain, infer, generate, create, receive, or access an individual’s location information.
(4) “Covered entity” means any individual, partnership, corporation, limited liability company, association, or other group, however organized. A covered entity includes all agents of the entity. A covered entity does not include a state or local agency, or any court of California, a clerk of the court, or a judge or justice thereof.
(5) “Disclose” means to make location information available to a third party, including, but not limited to, by sharing, publishing, releasing, transferring, disseminating, providing access to, or otherwise communicating that location information orally, in writing, electronically, or by any other
means.
(6) “Facial recognition technology” or “FRT” means a system that compares a probe image of an unidentified human face against a reference photograph database, and, based on biometric data, generates possible matches to aid in identifying the person in the probe image.
(7) “Individual” means a natural person located within the State of California.
(8) “Location information” means information derived from a device or from interactions between devices, with or without the knowledge of the user and regardless of the technological method used, that pertains to or directly or indirectly reveals the present or past geographical location of an individual or device within the State of California with sufficient precision to identify street-level location information within a range of five miles or less. Location
information includes, but is not limited to, the following:
(A) An internet protocol address capable of revealing the physical or geographical location of an individual.
(B) Global Positioning System (GPS) coordinates.
(C) Cell-site location information.
(D) Information captured by an automated license plate recognition system that could be used to identify the specific location of an automobile at a point in time.
(E) Information or image captured by a speed safety system or other traffic monitoring system that could be used to identify the specific location of an automobile at a point in time.
(F) A video or photographic
image that is used as a probe image in a facial recognition technology system that could be used to identify the specific location of an individual at a point in time.
(9) “Monetize” means to collect, process, or disclose an individual’s location information for profit or in exchange for monetary or other consideration. This term includes, but is not limited to, selling, renting, trading, or leasing location information. “Monetize” shall not include the disclosure of public records for purposes of the California Public Records Act (Division 10 (commencing with Section 7920.000) of Title 1 of the Government Code).
(10) “Probe image” means an image of a person that is searched against a database of known, identified persons or an unsolved photograph file.
(11) “Service provider ” means an individual, partnership,
corporation, limited liability company, association, or other group, however organized, that collects, processes, or transfers location information for the sole purpose of, and only to the extent that the service provider is, conducting business activities on behalf of, for the benefit of, at the direction of, and under contractual agreement with a covered entity.
(12) “Speed safety system” means a fixed or mobile radar or laser system or any other electronic device that utilizes automated equipment to detect a violation of speed laws and obtains a clear photograph of a speeding vehicle’s license plate.
1798.90.76.
(a) A covered entity shall not collect or use the location information of an individual unless doing so is necessary to provide goods or services requested by that individual and the individual has expressly opted into the collection or use of their location information for that purpose.(b) It is unlawful for a covered entity or service provider that collects or uses location information to do any of the following:
(1) Collect more precise location information than necessary to provide the goods or services requested by the individual.
(2) Retain location information longer than necessary to provide the goods
or services requested by the individual.
(3) Sell, rent, trade, or lease location information to third parties.
(4) Derive or infer from location information any data that is not necessary to provide the goods or services requested by the individual.
(5) Disclose, cause to disclose, or assist with or facilitate the disclosure of an individual’s location information to third parties, unless the disclosure is necessary to provide the goods or services requested by the individual for which the information was collected, or requested by the individual to whom the location data pertains.
(c) It is unlawful for a covered entity or service provider to disclose location information to any federal, state, or local government agency or official unless the agency
or official serves the covered entity or service provider with a valid court order issued by a California court or a court order from another jurisdiction that is in keeping with California’s laws, including, but not limited to:
(1) The Reproductive Privacy Act (Article 2.5 (commencing with Section 123460) of Chapter 2 of Part 2 of Division 106 of the Health and Safety Code).
(2) A foreign penal civil action, as defined in Section 2029.200 of the Code of Civil Procedure.
(d) It is unlawful for a state or local agency to monetize location information.
1798.90.77.
(a) A covered entity shall prominently display, at the point where location information is being captured, a notice to individuals stating that their location information is being collected, the name of the covered entity and service provider collecting the information, and a phone number and an internet website where the individual can obtain more information.(b) A covered entity shall maintain and make available to the data subject a location privacy policy, which shall include, at a minimum, all of the following:
(1) The goods or services requested by the individual for which the covered entity is collecting, processing, or disclosing any location information.
(2) The type of location information collected, including the precision of the data.
(3) The identities of service providers with which the covered entity contracts with respect to location data.
(4) Any disclosures of location data necessary to provide the goods or services requested by the individual and the identities of the third parties to whom the location information could be disclosed.
(5) Whether the covered entity’s practices include the internal use of location information for purposes of targeted advertisement.
(6) The data management and data security policies governing location information.
(7) The retention
schedule and guidelines for permanently deleting location information.
(c) A covered entity in lawful possession of location information shall provide notice to individuals to whom that information pertains of any change to its location privacy policy at least 20 business days before the change goes into effect, and shall request and obtain consent before collecting or processing location information in accordance with the new location privacy policy.
1798.90.78.
(a) Whoever denies a right protected by this title, or aids, incites, or conspires in that denial, is liable for each and every offense for the actual damages suffered by any person denied that right and, in addition, all of the following:(1) An amount to be determined by a jury, or a court sitting without a jury, for exemplary damages.
(2) A civil penalty of twenty-five thousand dollars ($25,000), to be awarded to the person denied the right protected by this title.
(3) Preventive relief, including permanent or temporary injunction, restraining order, or other order against the person or persons responsible
for the conduct, as the complainant deems necessary to ensure the full enjoyment of the rights described in this title.
(4) Upon a motion, a court shall award reasonable attorney’s fees and costs, including expert witness fees and other litigation expenses, to a prevailing plaintiff in an action brought pursuant to this section. In awarding reasonable attorney’s fees, the court shall consider the degree to which the relief obtained relates to the relief sought.
(b) Either of the following public entities may bring a civil action against a covered entity for a violation of this title:
(1) The Attorney General in the name of the people of the State of California.
(2) A district attorney, county counsel, or city attorney for the jurisdiction in which the
violation occurred.
(c) An action under this section shall be commenced within three years of the alleged violation of this title.
