Amended IN Senate January 03, 2022 Amended IN Senate June 29, 2021 CALIFORNIA LEGISLATURE 20212022 REGULAR SESSION Assembly Bill No. 1262Introduced by Assembly Member Cunningham(Coauthor: Assembly Member Wicks)February 19, 2021An act to amend Sections 22948.20 22948.20, 22948.21, and 22948.23 of, and to amend the heading of Chapter 35 (commencing with Section 22948.20) of Division 8 of, and to amend, repeal, and add Section 22948.21 of, the Business and Professions Code, relating to information privacy.LEGISLATIVE COUNSEL'S DIGESTAB 1262, as amended, Cunningham. Information privacy: other connected device with a voice recognition feature.Existing law prohibits a person or entity from providing the operation of a voice recognition feature of a connected television within the state without prominently informing the specified user of the connected television during the initial setup or installation. Existing law prohibits any actual recordings of spoken word collected for a specified purpose through the operation of a voice recognition feature by the manufacturer of a connected television, or a contracting third party, from being sold or used for any advertising purpose. Existing law prohibits a person or entity from compelling a manufacturer or other entity providing the operation of a voice recognition feature to build specific features for the purpose of allowing an investigative or law enforcement officer to monitor communications through that feature.Existing law limits the liability of a manufacturer to functionality provided at the time of the original sale of a connected television and specifically excludes liability for functionality provided by applications the user chooses to use in the cloud or that are downloaded and installed by a user. Existing law prohibits a waiver of these prohibitions and authorizes their enforcement by injunction or civil penalty in a court of competent jurisdiction by the Attorney General or a district attorney. Existing law defines terms for these purposes.This bill would include smart speaker devices, as defined, within the scope of those provisions. The bill would prohibit any actual recordings or transcriptions collected or retained through the operation of a voice recognition feature by the manufacturer of a connected television or smart speaker device, that qualify as personal information or that are not deidentified, from being used for any advertising purpose, or being shared with, or sold to, a third party, unless the user has provided affirmative consent, as defined and specified, or the information is shared for certain limited purposes. The bill would also prohibit the use of recordings made from an incorrect activation of the device, except as specified. The bill would also prohibit the manufacturer from retaining the recordings or transcripts, as specified, unless the user opts in. The bill would provide certain exemptions, exemptions and would define related terms.Existing law, an initiative measure that will take effect January 1, 2023, includes a definition of consent pertaining to consumer privacy.This bill would, until that date, incorporate a materially similar definition of consent in the prohibition of use of recordings or transcriptions absent affirmative consent, as specified and defined. This bill would, commencing January 1, 2023, would expressly incorporate the initiative measures definition of consent into the definition of affirmative consent. consent for the purposes of these provisions.Digest Key Vote: MAJORITY Appropriation: NO Fiscal Committee: YES Local Program: NO Bill TextThe people of the State of California do enact as follows:SECTION 1. It is the intent of the Legislature that this act shall not be construed to limit consumer privacy protection required pursuant to the California Consumer Privacy Act of 2018 (Title 1.81.5 (commencing with Section 1798.100) of Part 4 of Division 3 of the Civil Code).SEC. 2. The heading of Chapter 35 (commencing with Section 22948.20) of Division 8 of the Business and Professions Code is amended to read: CHAPTER 35. Connected Televisions and DevicesSEC. 3. Section 22948.20 of the Business and Professions Code is amended to read:22948.20. (a) A person or entity shall not provide the operation of a voice recognition feature within this state without prominently informing, during the initial setup or installation of a connected television or smart speaker device, either the user or the person designated by the user to perform the initial setup or installation of the connected television or smart speaker device of both of the following:(1) That the connected television or smart speaker device contains a voice recognition feature.(2) What actions or commands will activate the voice recognition feature to record or transcribe audio.(b) A recording or transcription collected or retained through the operation of a voice recognition feature by the manufacturer of a connected television or smart speaker device, including, but not limited to, the operation of an accessible user interface for people with disabilities, if the recording or transcription qualifies as personal information or is not deidentified, shall not be:(1) Used for any advertising purpose.(2) Shared with, or sold to, a third party, unless the user has provided affirmative consent.(3) Retained electronically, unless the user opts in to having that recording retained by the manufacturer either during installation or at a later time in the device settings.(c) Notwithstanding paragraph (2) of subdivision (b), a manufacturer may share information with a third party without affirmative consent to the extent sharing that information is necessary to execute a function or provide a service specifically requested by the user, provided the third party manufacturer does not use that information for any purpose other than to facilitate the execution of that function or provision of that service.(d) If a user has provided affirmative consent for the sharing or sale of a recording or transcription as provided in paragraph (2) of subdivision (b), the manufacturer shall provide the user with the option to revoke that consent at any time in a manner reasonably accessible to the user.(e) If a user has declined to provide affirmative consent for the sharing or sale of a recording or transcription as provided in paragraph (2) of subdivision (b), the person or entity seeking consent shall not request that affirmative consent for a period of at least 12 months one month after the user has declined to provide that affirmative consent. consent, or when the user attempts to access a function that requires affirmative consent.(f) If a person or entity providing the operation of a device with a voice recognition feature within this state retains voice recordings that qualify as personal information or are not deidentified, that person or entity shall provide users with both of the following:(1) An interface to review and delete those voice recordings. The interface shall be easily accessible and the users rights provided by this chapter with respect to these recordings shall be clearly communicated to the user.(2) The ability to delete those voice recordings automatically.(g) (1) If a person or entity providing the operation of a voice recognition feature that can be activated by a voice command determines that the voice recognition feature was incorrectly activated, the person or entity shall not use the associated audio recording for any purpose, except as specified in paragraph (2).(2) A person or entity providing the operation of a voice recognition feature that can be activated by a voice command may use an audio recording associated with an incorrect activation of a voice recognition feature to improve the accuracy of the voice recognition feature, provided that the user has provided affirmative consent for the use of the audio recording for that purpose.(h) A person or entity shall not compel a manufacturer or other entity providing the operation of a voice recognition feature to build specific features for the purpose of allowing an investigative or law enforcement officer to monitor communications through that feature.(i) A manufacturer shall not be liable for functionality provided by applications that the user chooses to use in the cloud or are downloaded and installed by a user, unless the manufacturer collects, controls, or has access to any personal information collected or elicited by the applications.(j) This chapter shall not apply to any product or service provided by a company covered under Section 637.5 of the Penal Code.(k) This chapter shall not apply to a product or service used only to record information described in subdivision (c) of Section 1798.145 of the Civil Code.(l) This chapter shall not apply to any device regulated by the United States Food and Drug Administration.SEC. 4. Section 22948.21 of the Business and Professions Code is amended to read:22948.21. For purposes of this chapter, the following definitions shall apply:(a) Affirmative consent means that a manufacturer of a connected television or smart speaker device has done all of the following:(1) Clearly and conspicuously disclosed to the user, separate from the device terms of use, all of the following to the extent applicable:(A) The device may be used to process and retain user recordings.(B) The recordings described in subparagraph (A) may be analyzed or shared with third parties.(C) The device may be used to process and retain transcriptions of spoken words.(D) The transcriptions described in subparagraph (C) may be analyzed or shared with third parties.(2) Clearly and conspicuously disclosed to the user, separate from the device terms of use, the extent to which the device can operate in the absence of consent for each practice described in the disclosure required by paragraph (1).(3) Received a freely given, specific, informed, and unambiguous indication consent, as defined in Section 1798.140 of the users wishes by which the user, including by a statement or by a clear affirmative action, signifies agreement to the processing of personal information relating to the user Civil Code, for each practice described in the disclosure required by paragraph (1). The following shall not satisfy the requirements of this paragraph:(A)Acceptance of a general or broad terms of use, or similar document, that contains descriptions of personal information processing along with other, unrelated information.(B)Hovering over, muting, pausing, or closing a given piece of content.(C)Agreement obtained through the use of dark patterns.(b) Cloud computing storage service has the same definition as the term is defined by the National Institute of Standards and Technology Special Publication 800-145, or a successor publication, and includes the service and deployment models referenced therein.(c) Connected television means a video device designed for home use to receive television signals and reproduce them on an integrated, physical screen display that exceeds 12 inches, except that this term shall not include a personal computer, portable device, or a separate device that connects physically or wirelessly to a television, including, but not limited to, a set-top box, video game console, or digital video recorder.(d)Dark pattern means a user interface designed or manipulated with the substantial effect of subverting or impairing user autonomy, decision-making, or choice.(e)(d) Deidentified has the same meaning as set forth in Section 1798.140 of the Civil Code.(f)(e) Personal information has the same meaning as set forth in Section 1798.140 of the Civil Code.(g)(f) Retained means saving or storing, or both saving and storing, voice recorded data longer than the minimum time necessary to complete a requested command by the user.(h)(g) (1) Smart speaker device means a speaker and voice command device offered for sale in this state with an integrated virtual assistant connected to a cloud computing storage service that uses hands-free verbal activation.(2) A smart speaker device does not include a cellular telephone, a tablet, a laptop computer with mobile data access, a pager, or a motor vehicle, as defined in Section 415 of the Vehicle Code, or any speaker or device associated with, or connected to, a vehicle.(i)(h) Third party has the same meaning as set forth in Section 1798.140 of the Civil Code.(j)(i) (1) User means a person who originally purchases, leases, or takes ownership of a connected television or smart speaker device or another person designated by the user to perform the initial setup or installation of the connected television or smart speaker device.(2) A person who is incidentally recorded when a voice recognition feature is activated by a user shall not be deemed to be a user.(k)(j) Voice recognition feature means the function of a connected television or smart speaker device with a voice recognition feature that allows the collection, recording, storage, analysis, transmission, interpretation, or other use of spoken words or other sounds, except that this term shall not include spoken words or other sounds that are not recorded, retained, or transmitted beyond the connected television or smart speaker device.(l)(k) Voice recorded data means audio recordings or transcriptions of those recordings collected through the operation of a voice recognition feature by the manufacturer of a connected television or smart speaker device.(m)This section shall remain in effect only until January 1, 2023, and as of that date is repealed.SEC. 5.Section 22948.21 is added to the Business and Professions Code, to read:22948.21.For purposes of this chapter, the following definitions shall apply:(a)Affirmative consent means that a manufacturer of a connected television or smart speaker device has done all of the following:(1)Clearly and conspicuously disclosed to the user, separate from the device terms of use, all of the following to the extent applicable:(A)The device may be used to process and retain user recordings.(B)The recordings described in subparagraph (A) may be analyzed or shared with third parties.(C)The device may be used to process and retain transcriptions of spoken words.(D)The transcriptions described in subparagraph (C) may be analyzed or shared with third parties.(2)Clearly and conspicuously disclosed to the user, separate from the device terms of use, the extent to which the device can operate in the absence of consent for each practice described in the disclosure required by paragraph (1).(3)Received consent, as defined in Section 1798.140 of the Civil Code, for each practice described in the disclosure required by paragraph (1).(b)Cloud computing storage service has the same definition as the term is defined by the National Institute of Standards and Technology Special Publication 800-145, or a successor publication, and includes the service and deployment models referenced therein.(c)Connected television means a video device designed for home use to receive television signals and reproduce them on an integrated, physical screen display that exceeds 12 inches, except that this term shall not include a personal computer, portable device, or a separate device that connects physically or wirelessly to a television, including, but not limited to, a set-top box, video game console, or digital video recorder.(d)Deidentified has the same meaning as set forth in Section 1798.140 of the Civil Code.(e)Personal information has the same meaning as set forth in Section 1798.140 of the Civil Code.(f)Retained means saving or storing, or both saving and storing, voice recorded data longer than the minimum time necessary to complete a requested command by the user.(g)(1)Smart speaker device means a speaker and voice command device offered for sale in this state with an integrated virtual assistant connected to a cloud computing storage service that uses hands-free verbal activation.(2)A smart speaker device does not include a cellular telephone, a tablet, a laptop computer with mobile data access, a pager, or a motor vehicle, as defined in Section 415 of the Vehicle Code, or any speaker or device associated with, or connected to, a vehicle.(h)Third party has the same meaning as set forth in Section 1798.140 of the Civil Code.(i)(1)User means a person who originally purchases, leases, or takes ownership of a connected television or smart speaker device or another person designated by the user to perform the initial setup or installation of the connected television or smart speaker device.(2)A person who is incidentally recorded when a voice recognition feature is activated by a user shall not be deemed to be a user.(j)Voice recognition feature means the function of a connected television or smart speaker device with a voice recognition feature that allows the collection, recording, storage, analysis, transmission, interpretation, or other use of spoken words or other sounds, except that this term shall not include spoken words or other sounds that are not recorded, retained, or transmitted beyond the connected television or smart speaker device.(k)Voice recorded data means audio recordings or transcriptions of those recordings collected through the operation of a voice recognition feature by the manufacturer of a connected television or smart speaker device.(l)This section shall become operative on January 1, 2023.SEC. 6.SEC. 5. Section 22948.23 of the Business and Professions Code is amended to read:22948.23. (a) Actions for relief pursuant to this chapter may be prosecuted exclusively in a court of competent jurisdiction in a civil action brought in the name of the people of the State of California by the Attorney General or by any district attorney. This chapter shall not be deemed to create a private right of action or limit any existing private right of action.(b) A court may enjoin a person who knowingly engages, has engaged, or proposes to engage, in a violation of this chapter. The court may make any orders or judgments as may be necessary to prevent a violation of this chapter.(c) A person who knowingly engages, has engaged, or proposes to engage, in a violation of this chapter shall be liable for a civil penalty not to exceed two thousand five hundred dollars ($2,500) for each connected television or smart speaker device sold or leased in violation of this chapter. If the action is brought by the Attorney General, the penalty shall be deposited into the General Fund. If the action is brought by a district attorney, the penalty shall be paid to the treasurer of the county in which the judgment was entered.
Amended IN Senate January 03, 2022 Amended IN Senate June 29, 2021 CALIFORNIA LEGISLATURE 20212022 REGULAR SESSION Assembly Bill No. 1262Introduced by Assembly Member Cunningham(Coauthor: Assembly Member Wicks)February 19, 2021An act to amend Sections 22948.20 22948.20, 22948.21, and 22948.23 of, and to amend the heading of Chapter 35 (commencing with Section 22948.20) of Division 8 of, and to amend, repeal, and add Section 22948.21 of, the Business and Professions Code, relating to information privacy.LEGISLATIVE COUNSEL'S DIGESTAB 1262, as amended, Cunningham. Information privacy: other connected device with a voice recognition feature.Existing law prohibits a person or entity from providing the operation of a voice recognition feature of a connected television within the state without prominently informing the specified user of the connected television during the initial setup or installation. Existing law prohibits any actual recordings of spoken word collected for a specified purpose through the operation of a voice recognition feature by the manufacturer of a connected television, or a contracting third party, from being sold or used for any advertising purpose. Existing law prohibits a person or entity from compelling a manufacturer or other entity providing the operation of a voice recognition feature to build specific features for the purpose of allowing an investigative or law enforcement officer to monitor communications through that feature.Existing law limits the liability of a manufacturer to functionality provided at the time of the original sale of a connected television and specifically excludes liability for functionality provided by applications the user chooses to use in the cloud or that are downloaded and installed by a user. Existing law prohibits a waiver of these prohibitions and authorizes their enforcement by injunction or civil penalty in a court of competent jurisdiction by the Attorney General or a district attorney. Existing law defines terms for these purposes.This bill would include smart speaker devices, as defined, within the scope of those provisions. The bill would prohibit any actual recordings or transcriptions collected or retained through the operation of a voice recognition feature by the manufacturer of a connected television or smart speaker device, that qualify as personal information or that are not deidentified, from being used for any advertising purpose, or being shared with, or sold to, a third party, unless the user has provided affirmative consent, as defined and specified, or the information is shared for certain limited purposes. The bill would also prohibit the use of recordings made from an incorrect activation of the device, except as specified. The bill would also prohibit the manufacturer from retaining the recordings or transcripts, as specified, unless the user opts in. The bill would provide certain exemptions, exemptions and would define related terms.Existing law, an initiative measure that will take effect January 1, 2023, includes a definition of consent pertaining to consumer privacy.This bill would, until that date, incorporate a materially similar definition of consent in the prohibition of use of recordings or transcriptions absent affirmative consent, as specified and defined. This bill would, commencing January 1, 2023, would expressly incorporate the initiative measures definition of consent into the definition of affirmative consent. consent for the purposes of these provisions.Digest Key Vote: MAJORITY Appropriation: NO Fiscal Committee: YES Local Program: NO
Amended IN Senate January 03, 2022 Amended IN Senate June 29, 2021
Amended IN Senate January 03, 2022
Amended IN Senate June 29, 2021
CALIFORNIA LEGISLATURE 20212022 REGULAR SESSION
Assembly Bill
No. 1262
Introduced by Assembly Member Cunningham(Coauthor: Assembly Member Wicks)February 19, 2021
Introduced by Assembly Member Cunningham(Coauthor: Assembly Member Wicks)
February 19, 2021
An act to amend Sections 22948.20 22948.20, 22948.21, and 22948.23 of, and to amend the heading of Chapter 35 (commencing with Section 22948.20) of Division 8 of, and to amend, repeal, and add Section 22948.21 of, the Business and Professions Code, relating to information privacy.
LEGISLATIVE COUNSEL'S DIGEST
## LEGISLATIVE COUNSEL'S DIGEST
AB 1262, as amended, Cunningham. Information privacy: other connected device with a voice recognition feature.
Existing law prohibits a person or entity from providing the operation of a voice recognition feature of a connected television within the state without prominently informing the specified user of the connected television during the initial setup or installation. Existing law prohibits any actual recordings of spoken word collected for a specified purpose through the operation of a voice recognition feature by the manufacturer of a connected television, or a contracting third party, from being sold or used for any advertising purpose. Existing law prohibits a person or entity from compelling a manufacturer or other entity providing the operation of a voice recognition feature to build specific features for the purpose of allowing an investigative or law enforcement officer to monitor communications through that feature.Existing law limits the liability of a manufacturer to functionality provided at the time of the original sale of a connected television and specifically excludes liability for functionality provided by applications the user chooses to use in the cloud or that are downloaded and installed by a user. Existing law prohibits a waiver of these prohibitions and authorizes their enforcement by injunction or civil penalty in a court of competent jurisdiction by the Attorney General or a district attorney. Existing law defines terms for these purposes.This bill would include smart speaker devices, as defined, within the scope of those provisions. The bill would prohibit any actual recordings or transcriptions collected or retained through the operation of a voice recognition feature by the manufacturer of a connected television or smart speaker device, that qualify as personal information or that are not deidentified, from being used for any advertising purpose, or being shared with, or sold to, a third party, unless the user has provided affirmative consent, as defined and specified, or the information is shared for certain limited purposes. The bill would also prohibit the use of recordings made from an incorrect activation of the device, except as specified. The bill would also prohibit the manufacturer from retaining the recordings or transcripts, as specified, unless the user opts in. The bill would provide certain exemptions, exemptions and would define related terms.Existing law, an initiative measure that will take effect January 1, 2023, includes a definition of consent pertaining to consumer privacy.This bill would, until that date, incorporate a materially similar definition of consent in the prohibition of use of recordings or transcriptions absent affirmative consent, as specified and defined. This bill would, commencing January 1, 2023, would expressly incorporate the initiative measures definition of consent into the definition of affirmative consent. consent for the purposes of these provisions.
Existing law prohibits a person or entity from providing the operation of a voice recognition feature of a connected television within the state without prominently informing the specified user of the connected television during the initial setup or installation. Existing law prohibits any actual recordings of spoken word collected for a specified purpose through the operation of a voice recognition feature by the manufacturer of a connected television, or a contracting third party, from being sold or used for any advertising purpose. Existing law prohibits a person or entity from compelling a manufacturer or other entity providing the operation of a voice recognition feature to build specific features for the purpose of allowing an investigative or law enforcement officer to monitor communications through that feature.
Existing law limits the liability of a manufacturer to functionality provided at the time of the original sale of a connected television and specifically excludes liability for functionality provided by applications the user chooses to use in the cloud or that are downloaded and installed by a user. Existing law prohibits a waiver of these prohibitions and authorizes their enforcement by injunction or civil penalty in a court of competent jurisdiction by the Attorney General or a district attorney. Existing law defines terms for these purposes.
This bill would include smart speaker devices, as defined, within the scope of those provisions. The bill would prohibit any actual recordings or transcriptions collected or retained through the operation of a voice recognition feature by the manufacturer of a connected television or smart speaker device, that qualify as personal information or that are not deidentified, from being used for any advertising purpose, or being shared with, or sold to, a third party, unless the user has provided affirmative consent, as defined and specified, or the information is shared for certain limited purposes. The bill would also prohibit the use of recordings made from an incorrect activation of the device, except as specified. The bill would also prohibit the manufacturer from retaining the recordings or transcripts, as specified, unless the user opts in. The bill would provide certain exemptions, exemptions and would define related terms.
Existing law, an initiative measure that will take effect January 1, 2023, includes a definition of consent pertaining to consumer privacy.
This bill would, until that date, incorporate a materially similar definition of consent in the prohibition of use of recordings or transcriptions absent affirmative consent, as specified and defined. This bill would, commencing January 1, 2023, would expressly incorporate the initiative measures definition of consent into the definition of affirmative consent. consent for the purposes of these provisions.
## Digest Key
## Bill Text
The people of the State of California do enact as follows:SECTION 1. It is the intent of the Legislature that this act shall not be construed to limit consumer privacy protection required pursuant to the California Consumer Privacy Act of 2018 (Title 1.81.5 (commencing with Section 1798.100) of Part 4 of Division 3 of the Civil Code).SEC. 2. The heading of Chapter 35 (commencing with Section 22948.20) of Division 8 of the Business and Professions Code is amended to read: CHAPTER 35. Connected Televisions and DevicesSEC. 3. Section 22948.20 of the Business and Professions Code is amended to read:22948.20. (a) A person or entity shall not provide the operation of a voice recognition feature within this state without prominently informing, during the initial setup or installation of a connected television or smart speaker device, either the user or the person designated by the user to perform the initial setup or installation of the connected television or smart speaker device of both of the following:(1) That the connected television or smart speaker device contains a voice recognition feature.(2) What actions or commands will activate the voice recognition feature to record or transcribe audio.(b) A recording or transcription collected or retained through the operation of a voice recognition feature by the manufacturer of a connected television or smart speaker device, including, but not limited to, the operation of an accessible user interface for people with disabilities, if the recording or transcription qualifies as personal information or is not deidentified, shall not be:(1) Used for any advertising purpose.(2) Shared with, or sold to, a third party, unless the user has provided affirmative consent.(3) Retained electronically, unless the user opts in to having that recording retained by the manufacturer either during installation or at a later time in the device settings.(c) Notwithstanding paragraph (2) of subdivision (b), a manufacturer may share information with a third party without affirmative consent to the extent sharing that information is necessary to execute a function or provide a service specifically requested by the user, provided the third party manufacturer does not use that information for any purpose other than to facilitate the execution of that function or provision of that service.(d) If a user has provided affirmative consent for the sharing or sale of a recording or transcription as provided in paragraph (2) of subdivision (b), the manufacturer shall provide the user with the option to revoke that consent at any time in a manner reasonably accessible to the user.(e) If a user has declined to provide affirmative consent for the sharing or sale of a recording or transcription as provided in paragraph (2) of subdivision (b), the person or entity seeking consent shall not request that affirmative consent for a period of at least 12 months one month after the user has declined to provide that affirmative consent. consent, or when the user attempts to access a function that requires affirmative consent.(f) If a person or entity providing the operation of a device with a voice recognition feature within this state retains voice recordings that qualify as personal information or are not deidentified, that person or entity shall provide users with both of the following:(1) An interface to review and delete those voice recordings. The interface shall be easily accessible and the users rights provided by this chapter with respect to these recordings shall be clearly communicated to the user.(2) The ability to delete those voice recordings automatically.(g) (1) If a person or entity providing the operation of a voice recognition feature that can be activated by a voice command determines that the voice recognition feature was incorrectly activated, the person or entity shall not use the associated audio recording for any purpose, except as specified in paragraph (2).(2) A person or entity providing the operation of a voice recognition feature that can be activated by a voice command may use an audio recording associated with an incorrect activation of a voice recognition feature to improve the accuracy of the voice recognition feature, provided that the user has provided affirmative consent for the use of the audio recording for that purpose.(h) A person or entity shall not compel a manufacturer or other entity providing the operation of a voice recognition feature to build specific features for the purpose of allowing an investigative or law enforcement officer to monitor communications through that feature.(i) A manufacturer shall not be liable for functionality provided by applications that the user chooses to use in the cloud or are downloaded and installed by a user, unless the manufacturer collects, controls, or has access to any personal information collected or elicited by the applications.(j) This chapter shall not apply to any product or service provided by a company covered under Section 637.5 of the Penal Code.(k) This chapter shall not apply to a product or service used only to record information described in subdivision (c) of Section 1798.145 of the Civil Code.(l) This chapter shall not apply to any device regulated by the United States Food and Drug Administration.SEC. 4. Section 22948.21 of the Business and Professions Code is amended to read:22948.21. For purposes of this chapter, the following definitions shall apply:(a) Affirmative consent means that a manufacturer of a connected television or smart speaker device has done all of the following:(1) Clearly and conspicuously disclosed to the user, separate from the device terms of use, all of the following to the extent applicable:(A) The device may be used to process and retain user recordings.(B) The recordings described in subparagraph (A) may be analyzed or shared with third parties.(C) The device may be used to process and retain transcriptions of spoken words.(D) The transcriptions described in subparagraph (C) may be analyzed or shared with third parties.(2) Clearly and conspicuously disclosed to the user, separate from the device terms of use, the extent to which the device can operate in the absence of consent for each practice described in the disclosure required by paragraph (1).(3) Received a freely given, specific, informed, and unambiguous indication consent, as defined in Section 1798.140 of the users wishes by which the user, including by a statement or by a clear affirmative action, signifies agreement to the processing of personal information relating to the user Civil Code, for each practice described in the disclosure required by paragraph (1). The following shall not satisfy the requirements of this paragraph:(A)Acceptance of a general or broad terms of use, or similar document, that contains descriptions of personal information processing along with other, unrelated information.(B)Hovering over, muting, pausing, or closing a given piece of content.(C)Agreement obtained through the use of dark patterns.(b) Cloud computing storage service has the same definition as the term is defined by the National Institute of Standards and Technology Special Publication 800-145, or a successor publication, and includes the service and deployment models referenced therein.(c) Connected television means a video device designed for home use to receive television signals and reproduce them on an integrated, physical screen display that exceeds 12 inches, except that this term shall not include a personal computer, portable device, or a separate device that connects physically or wirelessly to a television, including, but not limited to, a set-top box, video game console, or digital video recorder.(d)Dark pattern means a user interface designed or manipulated with the substantial effect of subverting or impairing user autonomy, decision-making, or choice.(e)(d) Deidentified has the same meaning as set forth in Section 1798.140 of the Civil Code.(f)(e) Personal information has the same meaning as set forth in Section 1798.140 of the Civil Code.(g)(f) Retained means saving or storing, or both saving and storing, voice recorded data longer than the minimum time necessary to complete a requested command by the user.(h)(g) (1) Smart speaker device means a speaker and voice command device offered for sale in this state with an integrated virtual assistant connected to a cloud computing storage service that uses hands-free verbal activation.(2) A smart speaker device does not include a cellular telephone, a tablet, a laptop computer with mobile data access, a pager, or a motor vehicle, as defined in Section 415 of the Vehicle Code, or any speaker or device associated with, or connected to, a vehicle.(i)(h) Third party has the same meaning as set forth in Section 1798.140 of the Civil Code.(j)(i) (1) User means a person who originally purchases, leases, or takes ownership of a connected television or smart speaker device or another person designated by the user to perform the initial setup or installation of the connected television or smart speaker device.(2) A person who is incidentally recorded when a voice recognition feature is activated by a user shall not be deemed to be a user.(k)(j) Voice recognition feature means the function of a connected television or smart speaker device with a voice recognition feature that allows the collection, recording, storage, analysis, transmission, interpretation, or other use of spoken words or other sounds, except that this term shall not include spoken words or other sounds that are not recorded, retained, or transmitted beyond the connected television or smart speaker device.(l)(k) Voice recorded data means audio recordings or transcriptions of those recordings collected through the operation of a voice recognition feature by the manufacturer of a connected television or smart speaker device.(m)This section shall remain in effect only until January 1, 2023, and as of that date is repealed.SEC. 5.Section 22948.21 is added to the Business and Professions Code, to read:22948.21.For purposes of this chapter, the following definitions shall apply:(a)Affirmative consent means that a manufacturer of a connected television or smart speaker device has done all of the following:(1)Clearly and conspicuously disclosed to the user, separate from the device terms of use, all of the following to the extent applicable:(A)The device may be used to process and retain user recordings.(B)The recordings described in subparagraph (A) may be analyzed or shared with third parties.(C)The device may be used to process and retain transcriptions of spoken words.(D)The transcriptions described in subparagraph (C) may be analyzed or shared with third parties.(2)Clearly and conspicuously disclosed to the user, separate from the device terms of use, the extent to which the device can operate in the absence of consent for each practice described in the disclosure required by paragraph (1).(3)Received consent, as defined in Section 1798.140 of the Civil Code, for each practice described in the disclosure required by paragraph (1).(b)Cloud computing storage service has the same definition as the term is defined by the National Institute of Standards and Technology Special Publication 800-145, or a successor publication, and includes the service and deployment models referenced therein.(c)Connected television means a video device designed for home use to receive television signals and reproduce them on an integrated, physical screen display that exceeds 12 inches, except that this term shall not include a personal computer, portable device, or a separate device that connects physically or wirelessly to a television, including, but not limited to, a set-top box, video game console, or digital video recorder.(d)Deidentified has the same meaning as set forth in Section 1798.140 of the Civil Code.(e)Personal information has the same meaning as set forth in Section 1798.140 of the Civil Code.(f)Retained means saving or storing, or both saving and storing, voice recorded data longer than the minimum time necessary to complete a requested command by the user.(g)(1)Smart speaker device means a speaker and voice command device offered for sale in this state with an integrated virtual assistant connected to a cloud computing storage service that uses hands-free verbal activation.(2)A smart speaker device does not include a cellular telephone, a tablet, a laptop computer with mobile data access, a pager, or a motor vehicle, as defined in Section 415 of the Vehicle Code, or any speaker or device associated with, or connected to, a vehicle.(h)Third party has the same meaning as set forth in Section 1798.140 of the Civil Code.(i)(1)User means a person who originally purchases, leases, or takes ownership of a connected television or smart speaker device or another person designated by the user to perform the initial setup or installation of the connected television or smart speaker device.(2)A person who is incidentally recorded when a voice recognition feature is activated by a user shall not be deemed to be a user.(j)Voice recognition feature means the function of a connected television or smart speaker device with a voice recognition feature that allows the collection, recording, storage, analysis, transmission, interpretation, or other use of spoken words or other sounds, except that this term shall not include spoken words or other sounds that are not recorded, retained, or transmitted beyond the connected television or smart speaker device.(k)Voice recorded data means audio recordings or transcriptions of those recordings collected through the operation of a voice recognition feature by the manufacturer of a connected television or smart speaker device.(l)This section shall become operative on January 1, 2023.SEC. 6.SEC. 5. Section 22948.23 of the Business and Professions Code is amended to read:22948.23. (a) Actions for relief pursuant to this chapter may be prosecuted exclusively in a court of competent jurisdiction in a civil action brought in the name of the people of the State of California by the Attorney General or by any district attorney. This chapter shall not be deemed to create a private right of action or limit any existing private right of action.(b) A court may enjoin a person who knowingly engages, has engaged, or proposes to engage, in a violation of this chapter. The court may make any orders or judgments as may be necessary to prevent a violation of this chapter.(c) A person who knowingly engages, has engaged, or proposes to engage, in a violation of this chapter shall be liable for a civil penalty not to exceed two thousand five hundred dollars ($2,500) for each connected television or smart speaker device sold or leased in violation of this chapter. If the action is brought by the Attorney General, the penalty shall be deposited into the General Fund. If the action is brought by a district attorney, the penalty shall be paid to the treasurer of the county in which the judgment was entered.
The people of the State of California do enact as follows:
## The people of the State of California do enact as follows:
SECTION 1. It is the intent of the Legislature that this act shall not be construed to limit consumer privacy protection required pursuant to the California Consumer Privacy Act of 2018 (Title 1.81.5 (commencing with Section 1798.100) of Part 4 of Division 3 of the Civil Code).
SECTION 1. It is the intent of the Legislature that this act shall not be construed to limit consumer privacy protection required pursuant to the California Consumer Privacy Act of 2018 (Title 1.81.5 (commencing with Section 1798.100) of Part 4 of Division 3 of the Civil Code).
SECTION 1. It is the intent of the Legislature that this act shall not be construed to limit consumer privacy protection required pursuant to the California Consumer Privacy Act of 2018 (Title 1.81.5 (commencing with Section 1798.100) of Part 4 of Division 3 of the Civil Code).
### SECTION 1.
SEC. 2. The heading of Chapter 35 (commencing with Section 22948.20) of Division 8 of the Business and Professions Code is amended to read: CHAPTER 35. Connected Televisions and Devices
SEC. 2. The heading of Chapter 35 (commencing with Section 22948.20) of Division 8 of the Business and Professions Code is amended to read:
### SEC. 2.
CHAPTER 35. Connected Televisions and Devices
CHAPTER 35. Connected Televisions and Devices
CHAPTER 35. Connected Televisions and Devices
CHAPTER 35. Connected Televisions and Devices
SEC. 3. Section 22948.20 of the Business and Professions Code is amended to read:22948.20. (a) A person or entity shall not provide the operation of a voice recognition feature within this state without prominently informing, during the initial setup or installation of a connected television or smart speaker device, either the user or the person designated by the user to perform the initial setup or installation of the connected television or smart speaker device of both of the following:(1) That the connected television or smart speaker device contains a voice recognition feature.(2) What actions or commands will activate the voice recognition feature to record or transcribe audio.(b) A recording or transcription collected or retained through the operation of a voice recognition feature by the manufacturer of a connected television or smart speaker device, including, but not limited to, the operation of an accessible user interface for people with disabilities, if the recording or transcription qualifies as personal information or is not deidentified, shall not be:(1) Used for any advertising purpose.(2) Shared with, or sold to, a third party, unless the user has provided affirmative consent.(3) Retained electronically, unless the user opts in to having that recording retained by the manufacturer either during installation or at a later time in the device settings.(c) Notwithstanding paragraph (2) of subdivision (b), a manufacturer may share information with a third party without affirmative consent to the extent sharing that information is necessary to execute a function or provide a service specifically requested by the user, provided the third party manufacturer does not use that information for any purpose other than to facilitate the execution of that function or provision of that service.(d) If a user has provided affirmative consent for the sharing or sale of a recording or transcription as provided in paragraph (2) of subdivision (b), the manufacturer shall provide the user with the option to revoke that consent at any time in a manner reasonably accessible to the user.(e) If a user has declined to provide affirmative consent for the sharing or sale of a recording or transcription as provided in paragraph (2) of subdivision (b), the person or entity seeking consent shall not request that affirmative consent for a period of at least 12 months one month after the user has declined to provide that affirmative consent. consent, or when the user attempts to access a function that requires affirmative consent.(f) If a person or entity providing the operation of a device with a voice recognition feature within this state retains voice recordings that qualify as personal information or are not deidentified, that person or entity shall provide users with both of the following:(1) An interface to review and delete those voice recordings. The interface shall be easily accessible and the users rights provided by this chapter with respect to these recordings shall be clearly communicated to the user.(2) The ability to delete those voice recordings automatically.(g) (1) If a person or entity providing the operation of a voice recognition feature that can be activated by a voice command determines that the voice recognition feature was incorrectly activated, the person or entity shall not use the associated audio recording for any purpose, except as specified in paragraph (2).(2) A person or entity providing the operation of a voice recognition feature that can be activated by a voice command may use an audio recording associated with an incorrect activation of a voice recognition feature to improve the accuracy of the voice recognition feature, provided that the user has provided affirmative consent for the use of the audio recording for that purpose.(h) A person or entity shall not compel a manufacturer or other entity providing the operation of a voice recognition feature to build specific features for the purpose of allowing an investigative or law enforcement officer to monitor communications through that feature.(i) A manufacturer shall not be liable for functionality provided by applications that the user chooses to use in the cloud or are downloaded and installed by a user, unless the manufacturer collects, controls, or has access to any personal information collected or elicited by the applications.(j) This chapter shall not apply to any product or service provided by a company covered under Section 637.5 of the Penal Code.(k) This chapter shall not apply to a product or service used only to record information described in subdivision (c) of Section 1798.145 of the Civil Code.(l) This chapter shall not apply to any device regulated by the United States Food and Drug Administration.
SEC. 3. Section 22948.20 of the Business and Professions Code is amended to read:
### SEC. 3.
22948.20. (a) A person or entity shall not provide the operation of a voice recognition feature within this state without prominently informing, during the initial setup or installation of a connected television or smart speaker device, either the user or the person designated by the user to perform the initial setup or installation of the connected television or smart speaker device of both of the following:(1) That the connected television or smart speaker device contains a voice recognition feature.(2) What actions or commands will activate the voice recognition feature to record or transcribe audio.(b) A recording or transcription collected or retained through the operation of a voice recognition feature by the manufacturer of a connected television or smart speaker device, including, but not limited to, the operation of an accessible user interface for people with disabilities, if the recording or transcription qualifies as personal information or is not deidentified, shall not be:(1) Used for any advertising purpose.(2) Shared with, or sold to, a third party, unless the user has provided affirmative consent.(3) Retained electronically, unless the user opts in to having that recording retained by the manufacturer either during installation or at a later time in the device settings.(c) Notwithstanding paragraph (2) of subdivision (b), a manufacturer may share information with a third party without affirmative consent to the extent sharing that information is necessary to execute a function or provide a service specifically requested by the user, provided the third party manufacturer does not use that information for any purpose other than to facilitate the execution of that function or provision of that service.(d) If a user has provided affirmative consent for the sharing or sale of a recording or transcription as provided in paragraph (2) of subdivision (b), the manufacturer shall provide the user with the option to revoke that consent at any time in a manner reasonably accessible to the user.(e) If a user has declined to provide affirmative consent for the sharing or sale of a recording or transcription as provided in paragraph (2) of subdivision (b), the person or entity seeking consent shall not request that affirmative consent for a period of at least 12 months one month after the user has declined to provide that affirmative consent. consent, or when the user attempts to access a function that requires affirmative consent.(f) If a person or entity providing the operation of a device with a voice recognition feature within this state retains voice recordings that qualify as personal information or are not deidentified, that person or entity shall provide users with both of the following:(1) An interface to review and delete those voice recordings. The interface shall be easily accessible and the users rights provided by this chapter with respect to these recordings shall be clearly communicated to the user.(2) The ability to delete those voice recordings automatically.(g) (1) If a person or entity providing the operation of a voice recognition feature that can be activated by a voice command determines that the voice recognition feature was incorrectly activated, the person or entity shall not use the associated audio recording for any purpose, except as specified in paragraph (2).(2) A person or entity providing the operation of a voice recognition feature that can be activated by a voice command may use an audio recording associated with an incorrect activation of a voice recognition feature to improve the accuracy of the voice recognition feature, provided that the user has provided affirmative consent for the use of the audio recording for that purpose.(h) A person or entity shall not compel a manufacturer or other entity providing the operation of a voice recognition feature to build specific features for the purpose of allowing an investigative or law enforcement officer to monitor communications through that feature.(i) A manufacturer shall not be liable for functionality provided by applications that the user chooses to use in the cloud or are downloaded and installed by a user, unless the manufacturer collects, controls, or has access to any personal information collected or elicited by the applications.(j) This chapter shall not apply to any product or service provided by a company covered under Section 637.5 of the Penal Code.(k) This chapter shall not apply to a product or service used only to record information described in subdivision (c) of Section 1798.145 of the Civil Code.(l) This chapter shall not apply to any device regulated by the United States Food and Drug Administration.
22948.20. (a) A person or entity shall not provide the operation of a voice recognition feature within this state without prominently informing, during the initial setup or installation of a connected television or smart speaker device, either the user or the person designated by the user to perform the initial setup or installation of the connected television or smart speaker device of both of the following:(1) That the connected television or smart speaker device contains a voice recognition feature.(2) What actions or commands will activate the voice recognition feature to record or transcribe audio.(b) A recording or transcription collected or retained through the operation of a voice recognition feature by the manufacturer of a connected television or smart speaker device, including, but not limited to, the operation of an accessible user interface for people with disabilities, if the recording or transcription qualifies as personal information or is not deidentified, shall not be:(1) Used for any advertising purpose.(2) Shared with, or sold to, a third party, unless the user has provided affirmative consent.(3) Retained electronically, unless the user opts in to having that recording retained by the manufacturer either during installation or at a later time in the device settings.(c) Notwithstanding paragraph (2) of subdivision (b), a manufacturer may share information with a third party without affirmative consent to the extent sharing that information is necessary to execute a function or provide a service specifically requested by the user, provided the third party manufacturer does not use that information for any purpose other than to facilitate the execution of that function or provision of that service.(d) If a user has provided affirmative consent for the sharing or sale of a recording or transcription as provided in paragraph (2) of subdivision (b), the manufacturer shall provide the user with the option to revoke that consent at any time in a manner reasonably accessible to the user.(e) If a user has declined to provide affirmative consent for the sharing or sale of a recording or transcription as provided in paragraph (2) of subdivision (b), the person or entity seeking consent shall not request that affirmative consent for a period of at least 12 months one month after the user has declined to provide that affirmative consent. consent, or when the user attempts to access a function that requires affirmative consent.(f) If a person or entity providing the operation of a device with a voice recognition feature within this state retains voice recordings that qualify as personal information or are not deidentified, that person or entity shall provide users with both of the following:(1) An interface to review and delete those voice recordings. The interface shall be easily accessible and the users rights provided by this chapter with respect to these recordings shall be clearly communicated to the user.(2) The ability to delete those voice recordings automatically.(g) (1) If a person or entity providing the operation of a voice recognition feature that can be activated by a voice command determines that the voice recognition feature was incorrectly activated, the person or entity shall not use the associated audio recording for any purpose, except as specified in paragraph (2).(2) A person or entity providing the operation of a voice recognition feature that can be activated by a voice command may use an audio recording associated with an incorrect activation of a voice recognition feature to improve the accuracy of the voice recognition feature, provided that the user has provided affirmative consent for the use of the audio recording for that purpose.(h) A person or entity shall not compel a manufacturer or other entity providing the operation of a voice recognition feature to build specific features for the purpose of allowing an investigative or law enforcement officer to monitor communications through that feature.(i) A manufacturer shall not be liable for functionality provided by applications that the user chooses to use in the cloud or are downloaded and installed by a user, unless the manufacturer collects, controls, or has access to any personal information collected or elicited by the applications.(j) This chapter shall not apply to any product or service provided by a company covered under Section 637.5 of the Penal Code.(k) This chapter shall not apply to a product or service used only to record information described in subdivision (c) of Section 1798.145 of the Civil Code.(l) This chapter shall not apply to any device regulated by the United States Food and Drug Administration.
22948.20. (a) A person or entity shall not provide the operation of a voice recognition feature within this state without prominently informing, during the initial setup or installation of a connected television or smart speaker device, either the user or the person designated by the user to perform the initial setup or installation of the connected television or smart speaker device of both of the following:(1) That the connected television or smart speaker device contains a voice recognition feature.(2) What actions or commands will activate the voice recognition feature to record or transcribe audio.(b) A recording or transcription collected or retained through the operation of a voice recognition feature by the manufacturer of a connected television or smart speaker device, including, but not limited to, the operation of an accessible user interface for people with disabilities, if the recording or transcription qualifies as personal information or is not deidentified, shall not be:(1) Used for any advertising purpose.(2) Shared with, or sold to, a third party, unless the user has provided affirmative consent.(3) Retained electronically, unless the user opts in to having that recording retained by the manufacturer either during installation or at a later time in the device settings.(c) Notwithstanding paragraph (2) of subdivision (b), a manufacturer may share information with a third party without affirmative consent to the extent sharing that information is necessary to execute a function or provide a service specifically requested by the user, provided the third party manufacturer does not use that information for any purpose other than to facilitate the execution of that function or provision of that service.(d) If a user has provided affirmative consent for the sharing or sale of a recording or transcription as provided in paragraph (2) of subdivision (b), the manufacturer shall provide the user with the option to revoke that consent at any time in a manner reasonably accessible to the user.(e) If a user has declined to provide affirmative consent for the sharing or sale of a recording or transcription as provided in paragraph (2) of subdivision (b), the person or entity seeking consent shall not request that affirmative consent for a period of at least 12 months one month after the user has declined to provide that affirmative consent. consent, or when the user attempts to access a function that requires affirmative consent.(f) If a person or entity providing the operation of a device with a voice recognition feature within this state retains voice recordings that qualify as personal information or are not deidentified, that person or entity shall provide users with both of the following:(1) An interface to review and delete those voice recordings. The interface shall be easily accessible and the users rights provided by this chapter with respect to these recordings shall be clearly communicated to the user.(2) The ability to delete those voice recordings automatically.(g) (1) If a person or entity providing the operation of a voice recognition feature that can be activated by a voice command determines that the voice recognition feature was incorrectly activated, the person or entity shall not use the associated audio recording for any purpose, except as specified in paragraph (2).(2) A person or entity providing the operation of a voice recognition feature that can be activated by a voice command may use an audio recording associated with an incorrect activation of a voice recognition feature to improve the accuracy of the voice recognition feature, provided that the user has provided affirmative consent for the use of the audio recording for that purpose.(h) A person or entity shall not compel a manufacturer or other entity providing the operation of a voice recognition feature to build specific features for the purpose of allowing an investigative or law enforcement officer to monitor communications through that feature.(i) A manufacturer shall not be liable for functionality provided by applications that the user chooses to use in the cloud or are downloaded and installed by a user, unless the manufacturer collects, controls, or has access to any personal information collected or elicited by the applications.(j) This chapter shall not apply to any product or service provided by a company covered under Section 637.5 of the Penal Code.(k) This chapter shall not apply to a product or service used only to record information described in subdivision (c) of Section 1798.145 of the Civil Code.(l) This chapter shall not apply to any device regulated by the United States Food and Drug Administration.
22948.20. (a) A person or entity shall not provide the operation of a voice recognition feature within this state without prominently informing, during the initial setup or installation of a connected television or smart speaker device, either the user or the person designated by the user to perform the initial setup or installation of the connected television or smart speaker device of both of the following:
(1) That the connected television or smart speaker device contains a voice recognition feature.
(2) What actions or commands will activate the voice recognition feature to record or transcribe audio.
(b) A recording or transcription collected or retained through the operation of a voice recognition feature by the manufacturer of a connected television or smart speaker device, including, but not limited to, the operation of an accessible user interface for people with disabilities, if the recording or transcription qualifies as personal information or is not deidentified, shall not be:
(1) Used for any advertising purpose.
(2) Shared with, or sold to, a third party, unless the user has provided affirmative consent.
(3) Retained electronically, unless the user opts in to having that recording retained by the manufacturer either during installation or at a later time in the device settings.
(c) Notwithstanding paragraph (2) of subdivision (b), a manufacturer may share information with a third party without affirmative consent to the extent sharing that information is necessary to execute a function or provide a service specifically requested by the user, provided the third party manufacturer does not use that information for any purpose other than to facilitate the execution of that function or provision of that service.
(d) If a user has provided affirmative consent for the sharing or sale of a recording or transcription as provided in paragraph (2) of subdivision (b), the manufacturer shall provide the user with the option to revoke that consent at any time in a manner reasonably accessible to the user.
(e) If a user has declined to provide affirmative consent for the sharing or sale of a recording or transcription as provided in paragraph (2) of subdivision (b), the person or entity seeking consent shall not request that affirmative consent for a period of at least 12 months one month after the user has declined to provide that affirmative consent. consent, or when the user attempts to access a function that requires affirmative consent.
(f) If a person or entity providing the operation of a device with a voice recognition feature within this state retains voice recordings that qualify as personal information or are not deidentified, that person or entity shall provide users with both of the following:
(1) An interface to review and delete those voice recordings. The interface shall be easily accessible and the users rights provided by this chapter with respect to these recordings shall be clearly communicated to the user.
(2) The ability to delete those voice recordings automatically.
(g) (1) If a person or entity providing the operation of a voice recognition feature that can be activated by a voice command determines that the voice recognition feature was incorrectly activated, the person or entity shall not use the associated audio recording for any purpose, except as specified in paragraph (2).
(2) A person or entity providing the operation of a voice recognition feature that can be activated by a voice command may use an audio recording associated with an incorrect activation of a voice recognition feature to improve the accuracy of the voice recognition feature, provided that the user has provided affirmative consent for the use of the audio recording for that purpose.
(h) A person or entity shall not compel a manufacturer or other entity providing the operation of a voice recognition feature to build specific features for the purpose of allowing an investigative or law enforcement officer to monitor communications through that feature.
(i) A manufacturer shall not be liable for functionality provided by applications that the user chooses to use in the cloud or are downloaded and installed by a user, unless the manufacturer collects, controls, or has access to any personal information collected or elicited by the applications.
(j) This chapter shall not apply to any product or service provided by a company covered under Section 637.5 of the Penal Code.
(k) This chapter shall not apply to a product or service used only to record information described in subdivision (c) of Section 1798.145 of the Civil Code.
(l) This chapter shall not apply to any device regulated by the United States Food and Drug Administration.
SEC. 4. Section 22948.21 of the Business and Professions Code is amended to read:22948.21. For purposes of this chapter, the following definitions shall apply:(a) Affirmative consent means that a manufacturer of a connected television or smart speaker device has done all of the following:(1) Clearly and conspicuously disclosed to the user, separate from the device terms of use, all of the following to the extent applicable:(A) The device may be used to process and retain user recordings.(B) The recordings described in subparagraph (A) may be analyzed or shared with third parties.(C) The device may be used to process and retain transcriptions of spoken words.(D) The transcriptions described in subparagraph (C) may be analyzed or shared with third parties.(2) Clearly and conspicuously disclosed to the user, separate from the device terms of use, the extent to which the device can operate in the absence of consent for each practice described in the disclosure required by paragraph (1).(3) Received a freely given, specific, informed, and unambiguous indication consent, as defined in Section 1798.140 of the users wishes by which the user, including by a statement or by a clear affirmative action, signifies agreement to the processing of personal information relating to the user Civil Code, for each practice described in the disclosure required by paragraph (1). The following shall not satisfy the requirements of this paragraph:(A)Acceptance of a general or broad terms of use, or similar document, that contains descriptions of personal information processing along with other, unrelated information.(B)Hovering over, muting, pausing, or closing a given piece of content.(C)Agreement obtained through the use of dark patterns.(b) Cloud computing storage service has the same definition as the term is defined by the National Institute of Standards and Technology Special Publication 800-145, or a successor publication, and includes the service and deployment models referenced therein.(c) Connected television means a video device designed for home use to receive television signals and reproduce them on an integrated, physical screen display that exceeds 12 inches, except that this term shall not include a personal computer, portable device, or a separate device that connects physically or wirelessly to a television, including, but not limited to, a set-top box, video game console, or digital video recorder.(d)Dark pattern means a user interface designed or manipulated with the substantial effect of subverting or impairing user autonomy, decision-making, or choice.(e)(d) Deidentified has the same meaning as set forth in Section 1798.140 of the Civil Code.(f)(e) Personal information has the same meaning as set forth in Section 1798.140 of the Civil Code.(g)(f) Retained means saving or storing, or both saving and storing, voice recorded data longer than the minimum time necessary to complete a requested command by the user.(h)(g) (1) Smart speaker device means a speaker and voice command device offered for sale in this state with an integrated virtual assistant connected to a cloud computing storage service that uses hands-free verbal activation.(2) A smart speaker device does not include a cellular telephone, a tablet, a laptop computer with mobile data access, a pager, or a motor vehicle, as defined in Section 415 of the Vehicle Code, or any speaker or device associated with, or connected to, a vehicle.(i)(h) Third party has the same meaning as set forth in Section 1798.140 of the Civil Code.(j)(i) (1) User means a person who originally purchases, leases, or takes ownership of a connected television or smart speaker device or another person designated by the user to perform the initial setup or installation of the connected television or smart speaker device.(2) A person who is incidentally recorded when a voice recognition feature is activated by a user shall not be deemed to be a user.(k)(j) Voice recognition feature means the function of a connected television or smart speaker device with a voice recognition feature that allows the collection, recording, storage, analysis, transmission, interpretation, or other use of spoken words or other sounds, except that this term shall not include spoken words or other sounds that are not recorded, retained, or transmitted beyond the connected television or smart speaker device.(l)(k) Voice recorded data means audio recordings or transcriptions of those recordings collected through the operation of a voice recognition feature by the manufacturer of a connected television or smart speaker device.(m)This section shall remain in effect only until January 1, 2023, and as of that date is repealed.
SEC. 4. Section 22948.21 of the Business and Professions Code is amended to read:
### SEC. 4.
22948.21. For purposes of this chapter, the following definitions shall apply:(a) Affirmative consent means that a manufacturer of a connected television or smart speaker device has done all of the following:(1) Clearly and conspicuously disclosed to the user, separate from the device terms of use, all of the following to the extent applicable:(A) The device may be used to process and retain user recordings.(B) The recordings described in subparagraph (A) may be analyzed or shared with third parties.(C) The device may be used to process and retain transcriptions of spoken words.(D) The transcriptions described in subparagraph (C) may be analyzed or shared with third parties.(2) Clearly and conspicuously disclosed to the user, separate from the device terms of use, the extent to which the device can operate in the absence of consent for each practice described in the disclosure required by paragraph (1).(3) Received a freely given, specific, informed, and unambiguous indication consent, as defined in Section 1798.140 of the users wishes by which the user, including by a statement or by a clear affirmative action, signifies agreement to the processing of personal information relating to the user Civil Code, for each practice described in the disclosure required by paragraph (1). The following shall not satisfy the requirements of this paragraph:(A)Acceptance of a general or broad terms of use, or similar document, that contains descriptions of personal information processing along with other, unrelated information.(B)Hovering over, muting, pausing, or closing a given piece of content.(C)Agreement obtained through the use of dark patterns.(b) Cloud computing storage service has the same definition as the term is defined by the National Institute of Standards and Technology Special Publication 800-145, or a successor publication, and includes the service and deployment models referenced therein.(c) Connected television means a video device designed for home use to receive television signals and reproduce them on an integrated, physical screen display that exceeds 12 inches, except that this term shall not include a personal computer, portable device, or a separate device that connects physically or wirelessly to a television, including, but not limited to, a set-top box, video game console, or digital video recorder.(d)Dark pattern means a user interface designed or manipulated with the substantial effect of subverting or impairing user autonomy, decision-making, or choice.(e)(d) Deidentified has the same meaning as set forth in Section 1798.140 of the Civil Code.(f)(e) Personal information has the same meaning as set forth in Section 1798.140 of the Civil Code.(g)(f) Retained means saving or storing, or both saving and storing, voice recorded data longer than the minimum time necessary to complete a requested command by the user.(h)(g) (1) Smart speaker device means a speaker and voice command device offered for sale in this state with an integrated virtual assistant connected to a cloud computing storage service that uses hands-free verbal activation.(2) A smart speaker device does not include a cellular telephone, a tablet, a laptop computer with mobile data access, a pager, or a motor vehicle, as defined in Section 415 of the Vehicle Code, or any speaker or device associated with, or connected to, a vehicle.(i)(h) Third party has the same meaning as set forth in Section 1798.140 of the Civil Code.(j)(i) (1) User means a person who originally purchases, leases, or takes ownership of a connected television or smart speaker device or another person designated by the user to perform the initial setup or installation of the connected television or smart speaker device.(2) A person who is incidentally recorded when a voice recognition feature is activated by a user shall not be deemed to be a user.(k)(j) Voice recognition feature means the function of a connected television or smart speaker device with a voice recognition feature that allows the collection, recording, storage, analysis, transmission, interpretation, or other use of spoken words or other sounds, except that this term shall not include spoken words or other sounds that are not recorded, retained, or transmitted beyond the connected television or smart speaker device.(l)(k) Voice recorded data means audio recordings or transcriptions of those recordings collected through the operation of a voice recognition feature by the manufacturer of a connected television or smart speaker device.(m)This section shall remain in effect only until January 1, 2023, and as of that date is repealed.
22948.21. For purposes of this chapter, the following definitions shall apply:(a) Affirmative consent means that a manufacturer of a connected television or smart speaker device has done all of the following:(1) Clearly and conspicuously disclosed to the user, separate from the device terms of use, all of the following to the extent applicable:(A) The device may be used to process and retain user recordings.(B) The recordings described in subparagraph (A) may be analyzed or shared with third parties.(C) The device may be used to process and retain transcriptions of spoken words.(D) The transcriptions described in subparagraph (C) may be analyzed or shared with third parties.(2) Clearly and conspicuously disclosed to the user, separate from the device terms of use, the extent to which the device can operate in the absence of consent for each practice described in the disclosure required by paragraph (1).(3) Received a freely given, specific, informed, and unambiguous indication consent, as defined in Section 1798.140 of the users wishes by which the user, including by a statement or by a clear affirmative action, signifies agreement to the processing of personal information relating to the user Civil Code, for each practice described in the disclosure required by paragraph (1). The following shall not satisfy the requirements of this paragraph:(A)Acceptance of a general or broad terms of use, or similar document, that contains descriptions of personal information processing along with other, unrelated information.(B)Hovering over, muting, pausing, or closing a given piece of content.(C)Agreement obtained through the use of dark patterns.(b) Cloud computing storage service has the same definition as the term is defined by the National Institute of Standards and Technology Special Publication 800-145, or a successor publication, and includes the service and deployment models referenced therein.(c) Connected television means a video device designed for home use to receive television signals and reproduce them on an integrated, physical screen display that exceeds 12 inches, except that this term shall not include a personal computer, portable device, or a separate device that connects physically or wirelessly to a television, including, but not limited to, a set-top box, video game console, or digital video recorder.(d)Dark pattern means a user interface designed or manipulated with the substantial effect of subverting or impairing user autonomy, decision-making, or choice.(e)(d) Deidentified has the same meaning as set forth in Section 1798.140 of the Civil Code.(f)(e) Personal information has the same meaning as set forth in Section 1798.140 of the Civil Code.(g)(f) Retained means saving or storing, or both saving and storing, voice recorded data longer than the minimum time necessary to complete a requested command by the user.(h)(g) (1) Smart speaker device means a speaker and voice command device offered for sale in this state with an integrated virtual assistant connected to a cloud computing storage service that uses hands-free verbal activation.(2) A smart speaker device does not include a cellular telephone, a tablet, a laptop computer with mobile data access, a pager, or a motor vehicle, as defined in Section 415 of the Vehicle Code, or any speaker or device associated with, or connected to, a vehicle.(i)(h) Third party has the same meaning as set forth in Section 1798.140 of the Civil Code.(j)(i) (1) User means a person who originally purchases, leases, or takes ownership of a connected television or smart speaker device or another person designated by the user to perform the initial setup or installation of the connected television or smart speaker device.(2) A person who is incidentally recorded when a voice recognition feature is activated by a user shall not be deemed to be a user.(k)(j) Voice recognition feature means the function of a connected television or smart speaker device with a voice recognition feature that allows the collection, recording, storage, analysis, transmission, interpretation, or other use of spoken words or other sounds, except that this term shall not include spoken words or other sounds that are not recorded, retained, or transmitted beyond the connected television or smart speaker device.(l)(k) Voice recorded data means audio recordings or transcriptions of those recordings collected through the operation of a voice recognition feature by the manufacturer of a connected television or smart speaker device.(m)This section shall remain in effect only until January 1, 2023, and as of that date is repealed.
22948.21. For purposes of this chapter, the following definitions shall apply:(a) Affirmative consent means that a manufacturer of a connected television or smart speaker device has done all of the following:(1) Clearly and conspicuously disclosed to the user, separate from the device terms of use, all of the following to the extent applicable:(A) The device may be used to process and retain user recordings.(B) The recordings described in subparagraph (A) may be analyzed or shared with third parties.(C) The device may be used to process and retain transcriptions of spoken words.(D) The transcriptions described in subparagraph (C) may be analyzed or shared with third parties.(2) Clearly and conspicuously disclosed to the user, separate from the device terms of use, the extent to which the device can operate in the absence of consent for each practice described in the disclosure required by paragraph (1).(3) Received a freely given, specific, informed, and unambiguous indication consent, as defined in Section 1798.140 of the users wishes by which the user, including by a statement or by a clear affirmative action, signifies agreement to the processing of personal information relating to the user Civil Code, for each practice described in the disclosure required by paragraph (1). The following shall not satisfy the requirements of this paragraph:(A)Acceptance of a general or broad terms of use, or similar document, that contains descriptions of personal information processing along with other, unrelated information.(B)Hovering over, muting, pausing, or closing a given piece of content.(C)Agreement obtained through the use of dark patterns.(b) Cloud computing storage service has the same definition as the term is defined by the National Institute of Standards and Technology Special Publication 800-145, or a successor publication, and includes the service and deployment models referenced therein.(c) Connected television means a video device designed for home use to receive television signals and reproduce them on an integrated, physical screen display that exceeds 12 inches, except that this term shall not include a personal computer, portable device, or a separate device that connects physically or wirelessly to a television, including, but not limited to, a set-top box, video game console, or digital video recorder.(d)Dark pattern means a user interface designed or manipulated with the substantial effect of subverting or impairing user autonomy, decision-making, or choice.(e)(d) Deidentified has the same meaning as set forth in Section 1798.140 of the Civil Code.(f)(e) Personal information has the same meaning as set forth in Section 1798.140 of the Civil Code.(g)(f) Retained means saving or storing, or both saving and storing, voice recorded data longer than the minimum time necessary to complete a requested command by the user.(h)(g) (1) Smart speaker device means a speaker and voice command device offered for sale in this state with an integrated virtual assistant connected to a cloud computing storage service that uses hands-free verbal activation.(2) A smart speaker device does not include a cellular telephone, a tablet, a laptop computer with mobile data access, a pager, or a motor vehicle, as defined in Section 415 of the Vehicle Code, or any speaker or device associated with, or connected to, a vehicle.(i)(h) Third party has the same meaning as set forth in Section 1798.140 of the Civil Code.(j)(i) (1) User means a person who originally purchases, leases, or takes ownership of a connected television or smart speaker device or another person designated by the user to perform the initial setup or installation of the connected television or smart speaker device.(2) A person who is incidentally recorded when a voice recognition feature is activated by a user shall not be deemed to be a user.(k)(j) Voice recognition feature means the function of a connected television or smart speaker device with a voice recognition feature that allows the collection, recording, storage, analysis, transmission, interpretation, or other use of spoken words or other sounds, except that this term shall not include spoken words or other sounds that are not recorded, retained, or transmitted beyond the connected television or smart speaker device.(l)(k) Voice recorded data means audio recordings or transcriptions of those recordings collected through the operation of a voice recognition feature by the manufacturer of a connected television or smart speaker device.(m)This section shall remain in effect only until January 1, 2023, and as of that date is repealed.
22948.21. For purposes of this chapter, the following definitions shall apply:
(a) Affirmative consent means that a manufacturer of a connected television or smart speaker device has done all of the following:
(1) Clearly and conspicuously disclosed to the user, separate from the device terms of use, all of the following to the extent applicable:
(A) The device may be used to process and retain user recordings.
(B) The recordings described in subparagraph (A) may be analyzed or shared with third parties.
(C) The device may be used to process and retain transcriptions of spoken words.
(D) The transcriptions described in subparagraph (C) may be analyzed or shared with third parties.
(2) Clearly and conspicuously disclosed to the user, separate from the device terms of use, the extent to which the device can operate in the absence of consent for each practice described in the disclosure required by paragraph (1).
(3) Received a freely given, specific, informed, and unambiguous indication consent, as defined in Section 1798.140 of the users wishes by which the user, including by a statement or by a clear affirmative action, signifies agreement to the processing of personal information relating to the user Civil Code, for each practice described in the disclosure required by paragraph (1). The following shall not satisfy the requirements of this paragraph:
(A)Acceptance of a general or broad terms of use, or similar document, that contains descriptions of personal information processing along with other, unrelated information.
(B)Hovering over, muting, pausing, or closing a given piece of content.
(C)Agreement obtained through the use of dark patterns.
(b) Cloud computing storage service has the same definition as the term is defined by the National Institute of Standards and Technology Special Publication 800-145, or a successor publication, and includes the service and deployment models referenced therein.
(c) Connected television means a video device designed for home use to receive television signals and reproduce them on an integrated, physical screen display that exceeds 12 inches, except that this term shall not include a personal computer, portable device, or a separate device that connects physically or wirelessly to a television, including, but not limited to, a set-top box, video game console, or digital video recorder.
(d)Dark pattern means a user interface designed or manipulated with the substantial effect of subverting or impairing user autonomy, decision-making, or choice.
(e)
(d) Deidentified has the same meaning as set forth in Section 1798.140 of the Civil Code.
(f)
(e) Personal information has the same meaning as set forth in Section 1798.140 of the Civil Code.
(g)
(f) Retained means saving or storing, or both saving and storing, voice recorded data longer than the minimum time necessary to complete a requested command by the user.
(h)
(g) (1) Smart speaker device means a speaker and voice command device offered for sale in this state with an integrated virtual assistant connected to a cloud computing storage service that uses hands-free verbal activation.
(2) A smart speaker device does not include a cellular telephone, a tablet, a laptop computer with mobile data access, a pager, or a motor vehicle, as defined in Section 415 of the Vehicle Code, or any speaker or device associated with, or connected to, a vehicle.
(i)
(h) Third party has the same meaning as set forth in Section 1798.140 of the Civil Code.
(j)
(i) (1) User means a person who originally purchases, leases, or takes ownership of a connected television or smart speaker device or another person designated by the user to perform the initial setup or installation of the connected television or smart speaker device.
(2) A person who is incidentally recorded when a voice recognition feature is activated by a user shall not be deemed to be a user.
(k)
(j) Voice recognition feature means the function of a connected television or smart speaker device with a voice recognition feature that allows the collection, recording, storage, analysis, transmission, interpretation, or other use of spoken words or other sounds, except that this term shall not include spoken words or other sounds that are not recorded, retained, or transmitted beyond the connected television or smart speaker device.
(l)
(k) Voice recorded data means audio recordings or transcriptions of those recordings collected through the operation of a voice recognition feature by the manufacturer of a connected television or smart speaker device.
(m)This section shall remain in effect only until January 1, 2023, and as of that date is repealed.
For purposes of this chapter, the following definitions shall apply:
(a)Affirmative consent means that a manufacturer of a connected television or smart speaker device has done all of the following:
(1)Clearly and conspicuously disclosed to the user, separate from the device terms of use, all of the following to the extent applicable:
(A)The device may be used to process and retain user recordings.
(B)The recordings described in subparagraph (A) may be analyzed or shared with third parties.
(C)The device may be used to process and retain transcriptions of spoken words.
(D)The transcriptions described in subparagraph (C) may be analyzed or shared with third parties.
(2)Clearly and conspicuously disclosed to the user, separate from the device terms of use, the extent to which the device can operate in the absence of consent for each practice described in the disclosure required by paragraph (1).
(3)Received consent, as defined in Section 1798.140 of the Civil Code, for each practice described in the disclosure required by paragraph (1).
(b)Cloud computing storage service has the same definition as the term is defined by the National Institute of Standards and Technology Special Publication 800-145, or a successor publication, and includes the service and deployment models referenced therein.
(c)Connected television means a video device designed for home use to receive television signals and reproduce them on an integrated, physical screen display that exceeds 12 inches, except that this term shall not include a personal computer, portable device, or a separate device that connects physically or wirelessly to a television, including, but not limited to, a set-top box, video game console, or digital video recorder.
(d)Deidentified has the same meaning as set forth in Section 1798.140 of the Civil Code.
(e)Personal information has the same meaning as set forth in Section 1798.140 of the Civil Code.
(f)Retained means saving or storing, or both saving and storing, voice recorded data longer than the minimum time necessary to complete a requested command by the user.
(g)(1)Smart speaker device means a speaker and voice command device offered for sale in this state with an integrated virtual assistant connected to a cloud computing storage service that uses hands-free verbal activation.
(2)A smart speaker device does not include a cellular telephone, a tablet, a laptop computer with mobile data access, a pager, or a motor vehicle, as defined in Section 415 of the Vehicle Code, or any speaker or device associated with, or connected to, a vehicle.
(h)Third party has the same meaning as set forth in Section 1798.140 of the Civil Code.
(i)(1)User means a person who originally purchases, leases, or takes ownership of a connected television or smart speaker device or another person designated by the user to perform the initial setup or installation of the connected television or smart speaker device.
(2)A person who is incidentally recorded when a voice recognition feature is activated by a user shall not be deemed to be a user.
(j)Voice recognition feature means the function of a connected television or smart speaker device with a voice recognition feature that allows the collection, recording, storage, analysis, transmission, interpretation, or other use of spoken words or other sounds, except that this term shall not include spoken words or other sounds that are not recorded, retained, or transmitted beyond the connected television or smart speaker device.
(k)Voice recorded data means audio recordings or transcriptions of those recordings collected through the operation of a voice recognition feature by the manufacturer of a connected television or smart speaker device.
(l)This section shall become operative on January 1, 2023.
SEC. 6.SEC. 5. Section 22948.23 of the Business and Professions Code is amended to read:22948.23. (a) Actions for relief pursuant to this chapter may be prosecuted exclusively in a court of competent jurisdiction in a civil action brought in the name of the people of the State of California by the Attorney General or by any district attorney. This chapter shall not be deemed to create a private right of action or limit any existing private right of action.(b) A court may enjoin a person who knowingly engages, has engaged, or proposes to engage, in a violation of this chapter. The court may make any orders or judgments as may be necessary to prevent a violation of this chapter.(c) A person who knowingly engages, has engaged, or proposes to engage, in a violation of this chapter shall be liable for a civil penalty not to exceed two thousand five hundred dollars ($2,500) for each connected television or smart speaker device sold or leased in violation of this chapter. If the action is brought by the Attorney General, the penalty shall be deposited into the General Fund. If the action is brought by a district attorney, the penalty shall be paid to the treasurer of the county in which the judgment was entered.
SEC. 6.SEC. 5. Section 22948.23 of the Business and Professions Code is amended to read:
### SEC. 6.SEC. 5.
22948.23. (a) Actions for relief pursuant to this chapter may be prosecuted exclusively in a court of competent jurisdiction in a civil action brought in the name of the people of the State of California by the Attorney General or by any district attorney. This chapter shall not be deemed to create a private right of action or limit any existing private right of action.(b) A court may enjoin a person who knowingly engages, has engaged, or proposes to engage, in a violation of this chapter. The court may make any orders or judgments as may be necessary to prevent a violation of this chapter.(c) A person who knowingly engages, has engaged, or proposes to engage, in a violation of this chapter shall be liable for a civil penalty not to exceed two thousand five hundred dollars ($2,500) for each connected television or smart speaker device sold or leased in violation of this chapter. If the action is brought by the Attorney General, the penalty shall be deposited into the General Fund. If the action is brought by a district attorney, the penalty shall be paid to the treasurer of the county in which the judgment was entered.
22948.23. (a) Actions for relief pursuant to this chapter may be prosecuted exclusively in a court of competent jurisdiction in a civil action brought in the name of the people of the State of California by the Attorney General or by any district attorney. This chapter shall not be deemed to create a private right of action or limit any existing private right of action.(b) A court may enjoin a person who knowingly engages, has engaged, or proposes to engage, in a violation of this chapter. The court may make any orders or judgments as may be necessary to prevent a violation of this chapter.(c) A person who knowingly engages, has engaged, or proposes to engage, in a violation of this chapter shall be liable for a civil penalty not to exceed two thousand five hundred dollars ($2,500) for each connected television or smart speaker device sold or leased in violation of this chapter. If the action is brought by the Attorney General, the penalty shall be deposited into the General Fund. If the action is brought by a district attorney, the penalty shall be paid to the treasurer of the county in which the judgment was entered.
22948.23. (a) Actions for relief pursuant to this chapter may be prosecuted exclusively in a court of competent jurisdiction in a civil action brought in the name of the people of the State of California by the Attorney General or by any district attorney. This chapter shall not be deemed to create a private right of action or limit any existing private right of action.(b) A court may enjoin a person who knowingly engages, has engaged, or proposes to engage, in a violation of this chapter. The court may make any orders or judgments as may be necessary to prevent a violation of this chapter.(c) A person who knowingly engages, has engaged, or proposes to engage, in a violation of this chapter shall be liable for a civil penalty not to exceed two thousand five hundred dollars ($2,500) for each connected television or smart speaker device sold or leased in violation of this chapter. If the action is brought by the Attorney General, the penalty shall be deposited into the General Fund. If the action is brought by a district attorney, the penalty shall be paid to the treasurer of the county in which the judgment was entered.
22948.23. (a) Actions for relief pursuant to this chapter may be prosecuted exclusively in a court of competent jurisdiction in a civil action brought in the name of the people of the State of California by the Attorney General or by any district attorney. This chapter shall not be deemed to create a private right of action or limit any existing private right of action.
(b) A court may enjoin a person who knowingly engages, has engaged, or proposes to engage, in a violation of this chapter. The court may make any orders or judgments as may be necessary to prevent a violation of this chapter.
(c) A person who knowingly engages, has engaged, or proposes to engage, in a violation of this chapter shall be liable for a civil penalty not to exceed two thousand five hundred dollars ($2,500) for each connected television or smart speaker device sold or leased in violation of this chapter. If the action is brought by the Attorney General, the penalty shall be deposited into the General Fund. If the action is brought by a district attorney, the penalty shall be paid to the treasurer of the county in which the judgment was entered.