Bill Text: CA AB1721 | 2023-2024 | Regular Session | Amended

---

Bill Title: Crimes: false depictions.

Spectrum: Partisan Bill (Republican 1-0)

Status: (Failed) 2024-02-01 - From committee: Filed with the Chief Clerk pursuant to Joint Rule 56. [AB1721 Detail]

Download: California-2023-AB1721-Amended.html

---

Amended  IN  Assembly  March 23, 2023

CALIFORNIA LEGISLATURE— 2023–2024 REGULAR SESSION

Assembly Bill

No. 1721

---

Introduced by Assembly Member Ta

February 17, 2023

---

An act to amend Section 1798.100 of the Civil Code, add Section 644 to the Penal Code, relating to privacy.

LEGISLATIVE COUNSEL'S DIGEST

AB 1721, as amended, Ta. California Consumer Privacy Act of 2018. Crimes: false depictions.

The California Constitution declares that all people have inalienable rights, including the right to pursue privacy.

Existing law makes it a crime to distribute intimate images of another person, as specified, that were intended to remain private, and that results in the serious emotional distress of the person depicted.

This bill would make it a crime for a person to knowingly, and without the consent of the depicted individual, distribute to, exhibit to, or exchange with others, or offer to distribute to, exhibit to, or exchange with others audio or visual media that falsely depicts an individual engaging in sexual conduct that would appear to a reasonable observer to be an authentic record of the conduct. By creating a new crime, this bill would impose a state-mandated local program.

The California Constitution requires the state to reimburse local agencies and school districts for certain costs mandated by the state. Statutory provisions establish procedures for making that reimbursement.

This bill would provide that no reimbursement is required by this act for a specified reason.

Existing law, the California Consumer Privacy Act of 2018 (CCPA), grants a consumer various rights with respect to personal information, as defined, that is collected or sold by a business, as defined, including requiring a business that collects a consumer’s personal information to disclose to that consumer the categories and specific pieces of personal information the business has collected. The California Privacy Rights Act of 2020, approved by the voters as Proposition 24 at the November 3, 2020, statewide general election, amended, added to, and reenacted the CCPA.

This bill would make nonsubstantive changes to those provisions.

Digest Key

Vote: MAJORITY   Appropriation: NO   Fiscal Committee: NOYES   Local Program: NOYES  

---

Bill Text

The people of the State of California do enact as follows:

SECTION 1.

 Section 644 is added to the Penal Code, to read:

644.

 (a) A person who knowingly and without the consent of the depicted individual distributes to, exhibits to, or exchanges with others or offers to distribute to, exhibit to, or exchange with others deepfake that depicts an individual personally engaging in sexual conduct, as defined in Section 311.4, shall be punished by a fine not exceeding one thousand dollars ($1,000) or by imprisonment in a county jail not exceeding one year, or by both that fine and imprisonment.

(b) No person shall be held liable under this section for any activity protected by the First Amendment to the Constitution of the United States.

(c) (1) As used in this section, “deepfake” means any audio or visual media in an electronic format, including any motion picture film or video recording, that is created or altered in a manner that it would falsely appear to a reasonable observer to be an authentic record of the actual speech or conduct of the individual depicted in the recording.

(2) As used in this section, “deepfake” does not include any material that constitutes a work of political, public interest, or newsworthy value, including commentary, criticism, satire, or parody, or that includes content, context, or a clear disclosure visible throughout the duration of the recording that would cause a reasonable person to understand that the audio or visual media is not a record of a real event.

(3) As used in this section, “distribute” means to publish, make available, or distribute to the public.

(4) As used in this section, distribution of deepfake does not include any alteration of a recording described in paragraph (2), including altering the length of the recording, so long as such alteration does not knowingly remove any content, context, or clear disclosure visible throughout the duration of the recording that would cause a reasonable person to believe that the audio or visual media is not a record of a real event.

SEC. 2.

 No reimbursement is required by this act pursuant to Section 6 of Article XIII B of the California Constitution because the only costs that may be incurred by a local agency or school district will be incurred because this act creates a new crime or infraction, eliminates a crime or infraction, or changes the penalty for a crime or infraction, within the meaning of Section 17556 of the Government Code, or changes the definition of a crime within the meaning of Section 6 of Article XIII B of the California Constitution.

SECTION 1.Section 1798.100 of the Civil Code is amended to read:

1798.100.

General Duties of Businesses that Collect Personal Information

(a)A business that controls the collection of a consumer’s personal information shall, at or before the point of collection, inform consumers of all of the following:

(1)The categories of personal information to be collected and the purposes for which the categories of personal information are collected or used and whether that information is sold or shared. A business shall not collect additional categories of personal information or use personal information collected for additional purposes that are incompatible with the disclosed purpose for which the personal information was collected without providing the consumer with notice consistent with this section.

(2)If the business collects sensitive personal information, the categories of sensitive personal information to be collected and the purposes for which the categories of sensitive personal information are collected or used, and whether that information is sold or shared. A business shall not collect additional categories of sensitive personal information or use sensitive personal information collected for additional purposes that are incompatible with the disclosed purpose for which the sensitive personal information was collected without providing the consumer with notice consistent with this section.

(3)The length of time the business intends to retain each category of personal information, including sensitive personal information, or if that is not possible, the criteria used to determine that period provided that a business shall not retain a consumer’s personal information or sensitive personal information for each disclosed purpose for which the personal information was collected for longer than is reasonably necessary for that disclosed purpose.

(b)A business that, acting as a third party, controls the collection of personal information about a consumer may satisfy its obligation under subdivision (a) by providing the required information prominently and conspicuously on the homepage of its internet website. In addition, if a business acting as a third party controls the collection of personal information about a consumer on its premises, including in a vehicle, then the business shall, at or before the point of collection, inform consumers as to the categories of personal information to be collected and the purposes for which the categories of personal information are used, and whether that personal information is sold, in a clear and conspicuous manner at the location.

(c)A business’ collection, use, retention, and sharing of a consumer’s personal information shall be reasonably necessary and proportionate to achieve the purposes for which the personal information was collected or processed, or for another disclosed purpose that is compatible with the context in which the personal information was collected, and not further processed in a manner that is incompatible with those purposes.

(d)A business that collects a consumer’s personal information and that sells that personal information to, or shares it with, a third party or that discloses it to a service provider or contractor for a business purpose shall enter into an agreement with the third party, service provider, or contractor, that does all of the following:

(1)Specifies that the personal information is sold or disclosed by the business only for limited and specified purposes.

(2)Obligates the third party, service provider, or contractor to comply with applicable obligations under this title and obligate those persons to provide the same level of privacy protection as is required by this title.

(3)Grants the business rights to take reasonable and appropriate steps to help ensure that the third party, service provider, or contractor uses the personal information transferred in a manner consistent with the business’ obligations under this title.

(4)Requires the third party, service provider, or contractor to notify the business if it makes a determination that it can no longer meet its obligations under this title.

(5)Grants the business the right, upon notice, including under paragraph (4), to take reasonable and appropriate steps to stop and remediate unauthorized use of personal information.

(e)A business that collects a consumer’s personal information shall implement reasonable security procedures and practices appropriate to the nature of the personal information to protect the personal information from unauthorized or illegal access, destruction, use, modification, or disclosure in accordance with Section 1798.81.5.

(f)Nothing in this section shall require a business to disclose trade secrets, as specified in regulations adopted pursuant to paragraph (3) of subdivision (a) of Section 1798.185.