22650.
A private entity may not use an electronic product code system that uses radio frequency identification (RFID) tags attached to consumer products or an RFID reader that enables the user to collect information from RFID tags attached to consumer products to gather, store, use, or share information that could be used to identify an individual, unless all of the following conditions are met:(a) The information is collected only to the extent permitted by law.
(b) The information has been provided by a customer for the purpose of completing a transaction to purchase or rent an item containing an RFID tag at a retail store.
(c) The information is not collected at any time before a customer actually initiates a transaction to purchase or rent an item or at any time after the customer completes the transaction.
(d) The information regards only a customer who actually presents the item for purchase or rent, and is in regard only to that item.