CALIFORNIA LEGISLATURE 20192020 REGULAR SESSION Assembly Bill No. 1465Introduced by Assembly Member BloomFebruary 22, 2019 An act to amend Section 22575 of the Business and Professions Code, relating to privacy.LEGISLATIVE COUNSEL'S DIGESTAB 1465, as introduced, Bloom. Internet privacy.Existing law requires an operator of a commercial internet website or online service that collects personally identifiable information through the internet about consumers residing in California who use or visit its commercial website or online service to conspicuously post its privacy policy on its website or online service and to comply with that policy. Existing law, among other things, requires that the privacy policy identify the categories of personally identifiable information that the operator collects about individual consumers who use or visit its website or online service and third parties with whom the operator shares the information, and whether other parties may collect personally identifiable information when a consumer uses the operators website or service.This bill would make nonsubstantive changes to these provisions.Digest Key Vote: MAJORITY Appropriation: NO Fiscal Committee: NO Local Program: NO Bill TextThe people of the State of California do enact as follows:SECTION 1. Section 22575 of the Business and Professions Code is amended to read:22575. (a) An operator of a commercial Web site website or online service that collects personally identifiable information through the Internet internet about individual consumers residing in California who use or visit its commercial Web site website or online service shall conspicuously post its privacy policy on its Web site, website, or in the case of an operator of an online service, make that policy available in accordance with paragraph (5) of subdivision (b) of Section 22577. An operator shall be in violation of this subdivision only if the operator fails to post its policy within 30 days after being notified of noncompliance.(b) The privacy policy required by subdivision (a) shall do all of the following:(1) Identify the categories of personally identifiable information that the operator collects through the Web site website or online service about individual consumers who use or visit its commercial Web site website or online service and the categories of third-party persons or entities with whom the operator may share that personally identifiable information.(2) If the operator maintains a process for an individual consumer who uses or visits its commercial Web site website or online service to review and request changes to any of his or her their personally identifiable information that is collected through the Web site website or online service, provide a description of that process.(3) Describe the process by which the operator notifies consumers who use or visit its commercial Web site website or online service of material changes to the operators privacy policy for that Web site website or online service.(4) Identify its effective date.(5) Disclose how the operator responds to Web web browser do not track signals or other mechanisms that provide consumers the ability to exercise choice regarding the collection of personally identifiable information about an individual consumers online activities over time and across third-party Web sites websites or online services, if the operator engages in that collection.(6) Disclose whether other parties may collect personally identifiable information about an individual consumers online activities over time and across different Web sites when websites if a consumer uses the operators Web site website or service.(7) An operator may satisfy the requirement of paragraph (5) by providing a clear and conspicuous hyperlink in the operators privacy policy to an online location containing a description, including the effects, of any program or protocol the operator follows that offers the consumer that choice.
CALIFORNIA LEGISLATURE 20192020 REGULAR SESSION Assembly Bill No. 1465Introduced by Assembly Member BloomFebruary 22, 2019 An act to amend Section 22575 of the Business and Professions Code, relating to privacy.LEGISLATIVE COUNSEL'S DIGESTAB 1465, as introduced, Bloom. Internet privacy.Existing law requires an operator of a commercial internet website or online service that collects personally identifiable information through the internet about consumers residing in California who use or visit its commercial website or online service to conspicuously post its privacy policy on its website or online service and to comply with that policy. Existing law, among other things, requires that the privacy policy identify the categories of personally identifiable information that the operator collects about individual consumers who use or visit its website or online service and third parties with whom the operator shares the information, and whether other parties may collect personally identifiable information when a consumer uses the operators website or service.This bill would make nonsubstantive changes to these provisions.Digest Key Vote: MAJORITY Appropriation: NO Fiscal Committee: NO Local Program: NO
CALIFORNIA LEGISLATURE 20192020 REGULAR SESSION
Assembly Bill No. 1465
Introduced by Assembly Member BloomFebruary 22, 2019
Introduced by Assembly Member Bloom
February 22, 2019
An act to amend Section 22575 of the Business and Professions Code, relating to privacy.
LEGISLATIVE COUNSEL'S DIGEST
## LEGISLATIVE COUNSEL'S DIGEST
AB 1465, as introduced, Bloom. Internet privacy.
Existing law requires an operator of a commercial internet website or online service that collects personally identifiable information through the internet about consumers residing in California who use or visit its commercial website or online service to conspicuously post its privacy policy on its website or online service and to comply with that policy. Existing law, among other things, requires that the privacy policy identify the categories of personally identifiable information that the operator collects about individual consumers who use or visit its website or online service and third parties with whom the operator shares the information, and whether other parties may collect personally identifiable information when a consumer uses the operators website or service.This bill would make nonsubstantive changes to these provisions.
Existing law requires an operator of a commercial internet website or online service that collects personally identifiable information through the internet about consumers residing in California who use or visit its commercial website or online service to conspicuously post its privacy policy on its website or online service and to comply with that policy. Existing law, among other things, requires that the privacy policy identify the categories of personally identifiable information that the operator collects about individual consumers who use or visit its website or online service and third parties with whom the operator shares the information, and whether other parties may collect personally identifiable information when a consumer uses the operators website or service.
This bill would make nonsubstantive changes to these provisions.
## Digest Key
## Bill Text
The people of the State of California do enact as follows:SECTION 1. Section 22575 of the Business and Professions Code is amended to read:22575. (a) An operator of a commercial Web site website or online service that collects personally identifiable information through the Internet internet about individual consumers residing in California who use or visit its commercial Web site website or online service shall conspicuously post its privacy policy on its Web site, website, or in the case of an operator of an online service, make that policy available in accordance with paragraph (5) of subdivision (b) of Section 22577. An operator shall be in violation of this subdivision only if the operator fails to post its policy within 30 days after being notified of noncompliance.(b) The privacy policy required by subdivision (a) shall do all of the following:(1) Identify the categories of personally identifiable information that the operator collects through the Web site website or online service about individual consumers who use or visit its commercial Web site website or online service and the categories of third-party persons or entities with whom the operator may share that personally identifiable information.(2) If the operator maintains a process for an individual consumer who uses or visits its commercial Web site website or online service to review and request changes to any of his or her their personally identifiable information that is collected through the Web site website or online service, provide a description of that process.(3) Describe the process by which the operator notifies consumers who use or visit its commercial Web site website or online service of material changes to the operators privacy policy for that Web site website or online service.(4) Identify its effective date.(5) Disclose how the operator responds to Web web browser do not track signals or other mechanisms that provide consumers the ability to exercise choice regarding the collection of personally identifiable information about an individual consumers online activities over time and across third-party Web sites websites or online services, if the operator engages in that collection.(6) Disclose whether other parties may collect personally identifiable information about an individual consumers online activities over time and across different Web sites when websites if a consumer uses the operators Web site website or service.(7) An operator may satisfy the requirement of paragraph (5) by providing a clear and conspicuous hyperlink in the operators privacy policy to an online location containing a description, including the effects, of any program or protocol the operator follows that offers the consumer that choice.
The people of the State of California do enact as follows:
## The people of the State of California do enact as follows:
SECTION 1. Section 22575 of the Business and Professions Code is amended to read:22575. (a) An operator of a commercial Web site website or online service that collects personally identifiable information through the Internet internet about individual consumers residing in California who use or visit its commercial Web site website or online service shall conspicuously post its privacy policy on its Web site, website, or in the case of an operator of an online service, make that policy available in accordance with paragraph (5) of subdivision (b) of Section 22577. An operator shall be in violation of this subdivision only if the operator fails to post its policy within 30 days after being notified of noncompliance.(b) The privacy policy required by subdivision (a) shall do all of the following:(1) Identify the categories of personally identifiable information that the operator collects through the Web site website or online service about individual consumers who use or visit its commercial Web site website or online service and the categories of third-party persons or entities with whom the operator may share that personally identifiable information.(2) If the operator maintains a process for an individual consumer who uses or visits its commercial Web site website or online service to review and request changes to any of his or her their personally identifiable information that is collected through the Web site website or online service, provide a description of that process.(3) Describe the process by which the operator notifies consumers who use or visit its commercial Web site website or online service of material changes to the operators privacy policy for that Web site website or online service.(4) Identify its effective date.(5) Disclose how the operator responds to Web web browser do not track signals or other mechanisms that provide consumers the ability to exercise choice regarding the collection of personally identifiable information about an individual consumers online activities over time and across third-party Web sites websites or online services, if the operator engages in that collection.(6) Disclose whether other parties may collect personally identifiable information about an individual consumers online activities over time and across different Web sites when websites if a consumer uses the operators Web site website or service.(7) An operator may satisfy the requirement of paragraph (5) by providing a clear and conspicuous hyperlink in the operators privacy policy to an online location containing a description, including the effects, of any program or protocol the operator follows that offers the consumer that choice.
SECTION 1. Section 22575 of the Business and Professions Code is amended to read:
### SECTION 1.
22575. (a) An operator of a commercial Web site website or online service that collects personally identifiable information through the Internet internet about individual consumers residing in California who use or visit its commercial Web site website or online service shall conspicuously post its privacy policy on its Web site, website, or in the case of an operator of an online service, make that policy available in accordance with paragraph (5) of subdivision (b) of Section 22577. An operator shall be in violation of this subdivision only if the operator fails to post its policy within 30 days after being notified of noncompliance.(b) The privacy policy required by subdivision (a) shall do all of the following:(1) Identify the categories of personally identifiable information that the operator collects through the Web site website or online service about individual consumers who use or visit its commercial Web site website or online service and the categories of third-party persons or entities with whom the operator may share that personally identifiable information.(2) If the operator maintains a process for an individual consumer who uses or visits its commercial Web site website or online service to review and request changes to any of his or her their personally identifiable information that is collected through the Web site website or online service, provide a description of that process.(3) Describe the process by which the operator notifies consumers who use or visit its commercial Web site website or online service of material changes to the operators privacy policy for that Web site website or online service.(4) Identify its effective date.(5) Disclose how the operator responds to Web web browser do not track signals or other mechanisms that provide consumers the ability to exercise choice regarding the collection of personally identifiable information about an individual consumers online activities over time and across third-party Web sites websites or online services, if the operator engages in that collection.(6) Disclose whether other parties may collect personally identifiable information about an individual consumers online activities over time and across different Web sites when websites if a consumer uses the operators Web site website or service.(7) An operator may satisfy the requirement of paragraph (5) by providing a clear and conspicuous hyperlink in the operators privacy policy to an online location containing a description, including the effects, of any program or protocol the operator follows that offers the consumer that choice.
22575. (a) An operator of a commercial Web site website or online service that collects personally identifiable information through the Internet internet about individual consumers residing in California who use or visit its commercial Web site website or online service shall conspicuously post its privacy policy on its Web site, website, or in the case of an operator of an online service, make that policy available in accordance with paragraph (5) of subdivision (b) of Section 22577. An operator shall be in violation of this subdivision only if the operator fails to post its policy within 30 days after being notified of noncompliance.(b) The privacy policy required by subdivision (a) shall do all of the following:(1) Identify the categories of personally identifiable information that the operator collects through the Web site website or online service about individual consumers who use or visit its commercial Web site website or online service and the categories of third-party persons or entities with whom the operator may share that personally identifiable information.(2) If the operator maintains a process for an individual consumer who uses or visits its commercial Web site website or online service to review and request changes to any of his or her their personally identifiable information that is collected through the Web site website or online service, provide a description of that process.(3) Describe the process by which the operator notifies consumers who use or visit its commercial Web site website or online service of material changes to the operators privacy policy for that Web site website or online service.(4) Identify its effective date.(5) Disclose how the operator responds to Web web browser do not track signals or other mechanisms that provide consumers the ability to exercise choice regarding the collection of personally identifiable information about an individual consumers online activities over time and across third-party Web sites websites or online services, if the operator engages in that collection.(6) Disclose whether other parties may collect personally identifiable information about an individual consumers online activities over time and across different Web sites when websites if a consumer uses the operators Web site website or service.(7) An operator may satisfy the requirement of paragraph (5) by providing a clear and conspicuous hyperlink in the operators privacy policy to an online location containing a description, including the effects, of any program or protocol the operator follows that offers the consumer that choice.
22575. (a) An operator of a commercial Web site website or online service that collects personally identifiable information through the Internet internet about individual consumers residing in California who use or visit its commercial Web site website or online service shall conspicuously post its privacy policy on its Web site, website, or in the case of an operator of an online service, make that policy available in accordance with paragraph (5) of subdivision (b) of Section 22577. An operator shall be in violation of this subdivision only if the operator fails to post its policy within 30 days after being notified of noncompliance.(b) The privacy policy required by subdivision (a) shall do all of the following:(1) Identify the categories of personally identifiable information that the operator collects through the Web site website or online service about individual consumers who use or visit its commercial Web site website or online service and the categories of third-party persons or entities with whom the operator may share that personally identifiable information.(2) If the operator maintains a process for an individual consumer who uses or visits its commercial Web site website or online service to review and request changes to any of his or her their personally identifiable information that is collected through the Web site website or online service, provide a description of that process.(3) Describe the process by which the operator notifies consumers who use or visit its commercial Web site website or online service of material changes to the operators privacy policy for that Web site website or online service.(4) Identify its effective date.(5) Disclose how the operator responds to Web web browser do not track signals or other mechanisms that provide consumers the ability to exercise choice regarding the collection of personally identifiable information about an individual consumers online activities over time and across third-party Web sites websites or online services, if the operator engages in that collection.(6) Disclose whether other parties may collect personally identifiable information about an individual consumers online activities over time and across different Web sites when websites if a consumer uses the operators Web site website or service.(7) An operator may satisfy the requirement of paragraph (5) by providing a clear and conspicuous hyperlink in the operators privacy policy to an online location containing a description, including the effects, of any program or protocol the operator follows that offers the consumer that choice.
22575. (a) An operator of a commercial Web site website or online service that collects personally identifiable information through the Internet internet about individual consumers residing in California who use or visit its commercial Web site website or online service shall conspicuously post its privacy policy on its Web site, website, or in the case of an operator of an online service, make that policy available in accordance with paragraph (5) of subdivision (b) of Section 22577. An operator shall be in violation of this subdivision only if the operator fails to post its policy within 30 days after being notified of noncompliance.
(b) The privacy policy required by subdivision (a) shall do all of the following:
(1) Identify the categories of personally identifiable information that the operator collects through the Web site website or online service about individual consumers who use or visit its commercial Web site website or online service and the categories of third-party persons or entities with whom the operator may share that personally identifiable information.
(2) If the operator maintains a process for an individual consumer who uses or visits its commercial Web site website or online service to review and request changes to any of his or her their personally identifiable information that is collected through the Web site website or online service, provide a description of that process.
(3) Describe the process by which the operator notifies consumers who use or visit its commercial Web site website or online service of material changes to the operators privacy policy for that Web site website or online service.
(4) Identify its effective date.
(5) Disclose how the operator responds to Web web browser do not track signals or other mechanisms that provide consumers the ability to exercise choice regarding the collection of personally identifiable information about an individual consumers online activities over time and across third-party Web sites websites or online services, if the operator engages in that collection.
(6) Disclose whether other parties may collect personally identifiable information about an individual consumers online activities over time and across different Web sites when websites if a consumer uses the operators Web site website or service.
(7) An operator may satisfy the requirement of paragraph (5) by providing a clear and conspicuous hyperlink in the operators privacy policy to an online location containing a description, including the effects, of any program or protocol the operator follows that offers the consumer that choice.