SB 299

Bill Subjects

Abstract

Existing law requires a business that owns, licenses, or maintains personal information about a California resident to implement and maintain reasonable security procedures and practices appropriate to the nature of the information, to protect the personal information from unauthorized access, destruction, use, modification, or disclosure. Existing federal law requires an operator of an internet website or online service directed to a child, as defined, or an operator of an internet website or online service that has actual knowledge that it is collecting personal information from a child to provide notice of what information is being collected and how that information is being used, and to give the parents of the child the opportunity to refuse to permit the operator's further collection of information from the child. Existing law prohibits an operator of an internet website, online service, online application, or mobile application, as specified, from marketing or advertising specified types of products or services to a minor. Existing law prohibits an operator from knowingly using, disclosing, compiling, or allowing a third party to use, disclose, or compile, the personal information of a minor for the purpose of marketing or advertising specified types of products or services. This bill would prohibit an operator of an internet website, online service, online application, or mobile application directed to minors, or an operator of an internet website, online service, online application, or mobile application that has actual knowledge that a minor is using its internet website, online service, online application, or mobile application, from using the personal information of a minor to direct content to the minor, or a group of individuals who are similar to the minor, based upon the minor's actual or perceived race, ethnicity, religion, physical or mental disability, medical condition, gender identity, gender expression, sexual orientation, sex, or socioeconomic background, or any other factor used as a proxy for identifying any of those characteristics. Existing law, beginning on January 1, 2020, requires a manufacturer of a connected device, as those terms are defined, to equip the device with a reasonable security feature or features that are appropriate to the nature and function of the device, appropriate to the information it may collect, contain, or transmit, and designed to protect the device and any information contained therein from unauthorized access, destruction, use, modification, or disclosure, as specified. This bill, beginning on January 1, 2021, would require a manufacturer of a connected device directed towards minors to prominently display on the packaging for the connected device a standardized and easy-to-understand privacy dashboard that details whether, what, and how personal information of a minor is collected, transmitted, retained, used, and protected, as specified.