Bill Text

Bill Information


PDF |Add To My Favorites |Track Bill | print page

AB-1395 Information privacy: other connected device with a voice recognition feature.(2019-2020)

SHARE THIS:share this bill in Facebookshare this bill in Twitter
Date Published: 07/09/2020 09:00 PM
AB1395:v94#DOCUMENT

Amended  IN  Senate  July 09, 2020
Amended  IN  Senate  June 26, 2019
Amended  IN  Assembly  May 22, 2019
Amended  IN  Assembly  May 06, 2019
Amended  IN  Assembly  April 08, 2019

CALIFORNIA LEGISLATURE— 2019–2020 REGULAR SESSION

Assembly Bill
No. 1395

Introduced by Assembly Member Cunningham
(Coauthors: Assembly Members Gallagher, Lackey, Limón, Mayes, and Wicks)

February 22, 2019

An act to amend Sections 22948.20, 22948.21, and 22948.23 of, and to amend the heading of Chapter 35 (commencing with Section 22948.20) of Division 8 of, the Business and Professions Code, relating to information privacy.


LEGISLATIVE COUNSEL'S DIGEST


AB 1395, as amended, Cunningham. Information privacy: other connected device with a voice recognition feature.
Existing law prohibits a person or entity from providing the operation of a voice recognition feature of a connected television within the state without prominently informing the specified user of the connected television during the initial setup or installation. Existing law prohibits any actual recordings of spoken word collected for a specified purpose through the operation of a voice recognition feature by the manufacturer of a connected television, or a contracting third party, from being sold or used for any advertising purpose. Existing law prohibits a person or entity from compelling a manufacturer or other entity providing the operation of a voice recognition feature to build specific features for the purpose of allowing an investigative or law enforcement officer to monitor communications through that feature. Existing law limits the liability of a manufacturer to functionality provided at the time of the original sale of a connected television and specifically excludes liability for functionality provided by applications the user chooses to use in the cloud or that are downloaded and installed by a user. Existing law prohibits a waiver of these prohibitions and authorizes their enforcement by injunction or civil penalty in a court of competent jurisdiction by the Attorney General or a district attorney. Existing law defines terms for these purposes.
This bill would include smart speaker devices, as defined, in those provisions, thereby prohibiting, among other things, a person or entity from providing the operation of a voice recognition feature within the state without prominently informing the user during the initial setup or installation of a smart speaker device. The bill would prohibit any actual recordings or transcriptions collected or retained through the operation of a voice recognition feature by the manufacturer of a connected television or smart speaker device, that qualify as personal information or that are not deidentified, from being used for any advertising purpose, or being shared with, or sold to, a third party. party, unless the user has provided affirmative written consent, as defined. The bill would also prohibit them from being retained by the manufacturer, as specified, without affirmative written or electronic consent, as defined. unless the user opts in to having that recording retained by the manufacturer either during installation or at a later time in the device settings. The bill would revise existing definitions and define additional terms for its purposes.
Vote: MAJORITY   Appropriation: NO   Fiscal Committee: YES   Local Program: NO  

The people of the State of California do enact as follows:


SECTION 1.

 It is the intent of the Legislature that this act shall not be construed to limit consumer privacy protection required pursuant to the California Consumer Privacy Act of 2018 (Title 1.81.5 (commencing with Section 1798.100) of Part 4 of Division 3 of the Civil Code).

SEC. 2.

 The heading of Chapter 35 (commencing with Section 22948.20) of Division 8 of the Business and Professions Code is amended to read:
CHAPTER  35. Connected Televisions and Devices

SEC. 3.

 Section 22948.20 of the Business and Professions Code is amended to read:

22948.20.
 (a) A person or entity shall not provide the operation of a voice recognition feature within this state without prominently informing, during the initial setup or installation of a connected television or smart speaker device, either the user or the person designated by the user to perform the initial setup or installation of the connected television or smart speaker device.
(b) A recording or transcription collected or retained through the operation of a voice recognition feature by the manufacturer of a connected television or smart speaker device, including, but not limited to, the operation of an accessible user interface for people with disabilities, if the recording or transcription qualifies as personal information or is not deidentified, shall not be:
(1) Used for any advertising purpose.
(2) Shared with, or sold to, a third party. party, unless the user has provided affirmative written consent.
(3) Retained at any location, either electronically or otherwise, other than the connected television or smart speaker device that is under the control of the user for personal or household purposes, such as backup, electronically, unless the user first provides affirmative written or electronic consent. opts in to having that recording retained by the manufacturer either during installation or at a later time in the device settings.
(c) A person or entity shall not compel a manufacturer or other entity providing the operation of a voice recognition feature to build specific features for the purpose of allowing an investigative or law enforcement officer to monitor communications through that feature.
(d) A manufacturer shall only be liable for functionality provided at the time of the original sale of a connected television or smart speaker device and shall not be liable for functionality provided by applications that the user chooses to use in the cloud or are downloaded and installed by a user. user, unless the manufacturer collects, controls, or has access to any personal information collected or elicited by the applications.
(e) This chapter shall not apply to any product or service provided by a company covered under Section 637.5 of the Penal Code.
(f) This chapter shall not apply to a product or service used only to record information described in subdivision (c) of Section 1798.145 of the Civil Code.
(g) This chapter shall not apply to any device regulated by the United States Food and Drug Administration.

SEC. 4.

 Section 22948.21 of the Business and Professions Code is amended to read:

22948.21.
 For purposes of this chapter, the following definitions shall apply:
(a) “Affirmative written or electronic consent” means that a manufacturer of a connected television or smart speaker device provided the following disclosure to a user during installation of a device, separate from the device terms of use: use, and received authorization from the user pursuant to the Electronic Signatures in Global and National Commerce Act (15 U.S.C. 7001 et seq.) and the Uniform Electronic Transactions Act (Title 2.5 (commencing with Section 1633.1) of Part 2 of Division 3 of the Civil Code):
This device may be used to process and retain user recordings and transcriptions of spoken words. Those recordings may be analyzed and shared with third parties by the manufacturer and its employees for the purpose of improving the device. Please indicate whether or not you give your consent for the device to be used in this way. This consent is not required to use the basic functions of this device.
I authorize [manufacturer name] to retain share my recordings recordings, and I understand that the recordings may be analyzed and shared with third parties by the manufacturer and its employees.
I do not authorize [manufacturer name] to retain share my recordings and I do not want to have access to the enhanced smart features of this device.
(b) “Cloud computing storage service” has the same definition as the term is defined by the National Institute of Standards and Technology Special Publication 800-145, or a successor publication, and includes the service and deployment models referenced therein.
(c) “Connected television” means a video device designed for home use to receive television signals and reproduce them on an integrated, physical screen display that exceeds 12 inches, except that this term shall not include a personal computer, portable device, or a separate device that connects physically or wirelessly to a television, including, but not limited to, a set-top box, video game console, or digital video recorder.
(d) “Deidentified” has the same meaning as set forth in subdivision (h) of Section 1798.140 of the Civil Code.
(e) “Personal information” has the same meaning as set forth in subdivision (o) of Section 1798.140 of the Civil Code.
(f) “Retained” means saving or storing, or both saving and storing, voice recorded data longer than the minimum time necessary to complete a requested command by the user.
(g) (1) “Smart speaker device” means a speaker and voice command device offered for sale in this state with an integrated virtual assistant connected to a cloud computing storage service that uses hands-free verbal activation. A smart speaker device does not include a cellular telephone, tablet, laptop computer with mobile data access, a pager, or a motor vehicle, as defined in Section 415 of the Vehicle Code, or any speaker or device associated with, or connected to, a vehicle.
(2) A smart speaker device does not include a cellular telephone, a tablet, a laptop computer with mobile data access, a pager, or a motor vehicle, as defined in Section 415 of the Vehicle Code, or any speaker or device associated with, or connected to, a vehicle.
(h) “Third party” has the same meaning as set forth in subdivision (w) of Section 1798.140 of the Civil Code.
(i) (1) “User” means a person who originally purchases, leases, or takes ownership of a connected television or smart speaker device or another person designated by the user to perform the initial setup or installation of the connected television or smart speaker device. A person who is incidentally recorded when a voice recognition feature is activated by a user shall not be deemed to be a user.
(2) A person who is incidentally recorded when a voice recognition feature is activated by a user shall not be deemed to be a user.
(j) “Voice recognition feature” means the function of a connected television or smart speaker device with a voice recognition feature that allows the collection, recording, storage, analysis, transmission, interpretation, or other use of spoken words or other sounds, except that this term shall not include spoken words or other sounds that are not recorded, retained, or transmitted beyond the connected television or smart speaker device.
(k) “Voice recorded data” means audio recordings or transcriptions of those recordings collected through the operation of a voice recognition feature by the manufacturer of a connected television or other connected device with a voice recognition feature. smart speaker device.

SEC. 5.

 Section 22948.23 of the Business and Professions Code is amended to read:

22948.23.
 (a) Actions for relief pursuant to this chapter may be prosecuted exclusively in a court of competent jurisdiction in a civil action brought in the name of the people of the State of California by the Attorney General or by any district attorney. This chapter shall not be deemed to create a private right of action, action or limit any existing private right of action.
(b) A court may enjoin a person who knowingly engages, has engaged, or proposes to engage, in a violation of this chapter. The court may make any orders or judgments as may be necessary to prevent a violation of this chapter.
(c) A person who knowingly engages, has engaged, or proposes to engage, in a violation of this chapter shall be liable for a civil penalty not to exceed two thousand five hundred dollars ($2,500) for each connected television or smart speaker device sold or leased in violation of this chapter. If the action is brought by the Attorney General, the penalty shall be deposited into the General Fund. If the action is brought by a district attorney, the penalty shall be paid to the treasurer of the county in which the judgment was entered.