california legislature--2013-14 regular session ASSEMBLY BILL No. 319 Introduced by Assembly Member Campos February 12, 2013 An act to add Chapter 22.1 (commencing with Section 22580) to Division 8 of the Business and Professions Code, relating to privacy. legislative counsel's digest AB 319, as introduced, Campos. Internet Web sites and online services: minors. Existing law requires an operator of a commercial Web site or online service that collects personally identifiable information through the Internet about individual consumers residing in California who use or visit its commercial Web site or online service to make its privacy policy available to the consumers, as specified. This bill would require an operator of an Internet Web site or online service directed to minors and the operator of an Internet Web site or online service that has actual knowledge that it is collecting personal information from a minor to provide notice on the Internet Web site of what information is collected from minors by the operator and how the operator uses the information. The bill would require the operator to provide specified information to the parent of a minor that has provided personal information to the Internet Web site or online service and to provide the parent with the opportunity to refuse to permit the operator's further use or future collection of personal information from the minor. The bill would prohibit an operator from conditioning a minor's participation in specified activities upon disclosure of more information than is reasonably necessary. The bill would require the operator of an Internet Web site or online service directed to minors to establish and 99 AB 319 --2-- maintain reasonable procedures to protect the confidentiality, security, and integrity of personal information collected from minors. Existing law specifies penalties for unfair competition, which includes an unlawful, unfair, or fraudulent business act or practice and unfair, deceptive, untrue, or misleading advertising. A civil action for enforcement of the prohibition on unfair competition may be brought in the name of the people of the state by the Attorney General, by any district attorney, by any county counsel authorized in actions involving violation of a county ordinance, by any city attorney of a city having a population in excess of 750,000, by any city attorney of any city and county, or, with the consent of the district attorney, by a city prosecutor in any city having a full-time city prosecutor, in any court of competent jurisdiction, or by a person who has suffered injury in fact and has lost money or property as a result of the unfair competition. This bill would make a violation of its provisions regulating operators of Internet Web sites and online services subject to enforcement under these provisions prohibiting unfair competition. Vote: majority. Appropriation: no. Fiscal committee: yes. State-mandated local program: no. The people of the State of California do enact as follows: line 1 line 2 line 3 line 4 line 5 line 6 line 7 line 8 line 9 line 10 line 11 line 12 line 13 line 14 line 15 line 16 line 17 line 18 SECTION 1. Chapter 22.1 (commencing with Section 22580) is added to Division 8 of the Business and Professions Code, to read: Chapter 22.1. Children's Online Privacy Protection 22580. For purposes of this chapter, the following definitions apply: (a) "Minor" means a person under 18 years of age. (b) "Operator" means a person that operates an online service or a Web site located on the Internet and that collects or maintains personal information from or about the users of, or visitors to, the Internet Web site or online service or on whose behalf the information is collected or maintained. (c) "Disclosure" means both of the following: (1) The release of personal information collected from a minor in identifiable form by an operator for any purpose, except where the information is provided to a person other than the operator that 99 --3-- line 1 line 2 line 3 line 4 line 5 line 6 line 7 line 8 line 9 line 10 line 11 line 12 line 13 line 14 line 15 line 16 line 17 line 18 line 19 line 20 line 21 line 22 line 23 line 24 line 25 line 26 line 27 line 28 line 29 line 30 line 31 line 32 line 33 line 34 line 35 line 36 line 37 line 38 line 39 AB 319 provides support for the internal operations of the Internet Web site and does not disclose or use that information for any other purpose. (2) Making personal information collected from a minor by an Internet Web site or online service directed to minors or with actual knowledge that such information was collected from a minor publicly available in identifiable form by any means, including by a public posting, through the Internet, or through a homepage of an Internet Web site, a pen pal service, an email service, a message board, or a chat room. (d) "Personal information" means individually identifiable information about an individual collected online, including a first and last name, a home or other physical address including street name and name of a city or town, an email address, a telephone number, a social security number, any other identifier that the department determines permits the physical or online contacting of a specific individual, or information concerning the minor or the parents of that minor that the Internet Web site collects online from the minor and combines with an identifier described in this paragraph. (e) "Internet Web site or online service directed to minors" means an Internet Web site or online service that is targeted to minors or that portion of an Internet Web site or online service that is targeted to minors. An Internet Web site or online service, or a portion of an Internet Web site or online service, shall not be deemed directed to minors solely for referring to or linking to a commercial Internet Web site or online service directed to minors by using information location tools, including a directory, index, reference, pointer, or hypertext link. (f) "Person" means any individual, partnership, corporation, trust, estate, cooperative, association, or other entity. (g) "Online contact information" means an email address or another substantially similar identifier that permits direct contact with a person online. 22581. (a) It is unlawful for an operator of an Internet Web site or online service directed to minors or an operator that has actual knowledge that it is collecting personal information from a minor to collect personal information from a minor in a manner that violates any of the following: 99 AB 319 line 1 line 2 line 3 line 4 line 5 line 6 line 7 line 8 line 9 line 10 line 11 line 12 line 13 line 14 line 15 line 16 line 17 line 18 line 19 line 20 line 21 line 22 line 23 line 24 line 25 line 26 line 27 line 28 line 29 --4-- (1) An operator of an Internet Web site or online service directed to minors that collects personal information from minors and the operator of an Internet Web site or online service that has actual knowledge that it is collecting personal information from a minor shall provide notice on the Internet Web site of what information is collected from minors by the operator and how the operator uses the information. (2) An operator shall provide to a parent whose minor dependent has provided personal information to an Internet Web site or online service, upon request of the parent and proper identification, a description of the specific types of personal information collected from the minor by the operator, the opportunity at any time to refuse to permit the operator's further use or maintenance in retrievable form, or future online collection, of personal information from the minor, and a means that is reasonable under the circumstances for the parent to obtain personal information collected from the minor. (3) A minor's participation in a game, the offering of a prize, or another activity shall not be conditioned on the minor disclosing more personal information than is reasonably necessary to participate in the activity. (4) An operator of an Internet Web site or online service directed to minors shall establish and maintain reasonable procedures to protect the confidentiality, security, and integrity of personal information collected from minors. (b) A violation of this section shall be treated as unfair competition and subject to the penalties imposed under Chapter 5 (commencing with Section 17200) of Part 2 of Division 7 of the Business and Professions Code. O 99