Bill Text

Bill Information


PDF |Add To My Favorites |Track Bill | print page

AB-1262 Information privacy: other connected device with a voice recognition feature.(2021-2022)

SHARE THIS:share this bill in Facebookshare this bill in Twitter
Date Published: 06/29/2021 09:00 PM
AB1262:v98#DOCUMENT

Amended  IN  Senate  June 29, 2021

CALIFORNIA LEGISLATURE— 2021–2022 REGULAR SESSION

Assembly Bill
No. 1262


Introduced by Assembly Member Cunningham
(Coauthor: Assembly Member Wicks)

February 19, 2021


An act to amend Sections 22948.20, 22948.21, 22948.20 and 22948.23 of, and to amend the heading of Chapter 35 (commencing with Section 22948.20) of Division 8 of, and to amend, repeal, and add Section 22948.21 of, the Business and Professions Code, relating to information privacy.


LEGISLATIVE COUNSEL'S DIGEST


AB 1262, as amended, Cunningham. Information privacy: other connected device with a voice recognition feature.
Existing law prohibits a person or entity from providing the operation of a voice recognition feature of a connected television within the state without prominently informing the specified user of the connected television during the initial setup or installation. Existing law prohibits any actual recordings of spoken word collected for a specified purpose through the operation of a voice recognition feature by the manufacturer of a connected television, or a contracting third party, from being sold or used for any advertising purpose. Existing law prohibits a person or entity from compelling a manufacturer or other entity providing the operation of a voice recognition feature to build specific features for the purpose of allowing an investigative or law enforcement officer to monitor communications through that feature.
Existing law limits the liability of a manufacturer to functionality provided at the time of the original sale of a connected television and specifically excludes liability for functionality provided by applications the user chooses to use in the cloud or that are downloaded and installed by a user. Existing law prohibits a waiver of these prohibitions and authorizes their enforcement by injunction or civil penalty in a court of competent jurisdiction by the Attorney General or a district attorney. Existing law defines terms for these purposes.
This bill would include smart speaker devices, as defined, within the scope of those provisions. The bill would prohibit any actual recordings or transcriptions collected or retained through the operation of a voice recognition feature by the manufacturer of a connected television or smart speaker device, that qualify as personal information or that are not deidentified, from being used for any advertising purpose, or being shared with, or sold to, a third party, unless the user has provided affirmative written consent, as defined. defined and specified, or the information is shared for certain limited purposes. The bill would also prohibit the use of recordings made from an incorrect activation of the device, except as specified. The bill would also prohibit the manufacturer from retaining the recordings or transcripts, as specified, unless the user opts in. The bill provide certain exemptions, and would define related terms.
Existing law, an initiative measure that will take effect January 1, 2023, includes a definition of “consent” pertaining to consumer privacy.
This bill would, until that date, incorporate a materially similar definition of “consent” in the prohibition of use of recordings or transcriptions absent affirmative consent, as specified and defined. This bill would, commencing January 1, 2023, expressly incorporate the initiative measure’s definition of consent into the definition of affirmative consent.
Vote: MAJORITY   Appropriation: NO   Fiscal Committee: YES   Local Program: NO  

The people of the State of California do enact as follows:


SECTION 1.

 It is the intent of the Legislature that this act shall not be construed to limit consumer privacy protection required pursuant to the California Consumer Privacy Act of 2018 (Title 1.81.5 (commencing with Section 1798.100) of Part 4 of Division 3 of the Civil Code).

SEC. 2.

 The heading of Chapter 35 (commencing with Section 22948.20) of Division 8 of the Business and Professions Code is amended to read:
CHAPTER  35. Connected Televisions and Devices

SEC. 3.

 Section 22948.20 of the Business and Professions Code is amended to read:

22948.20.
 (a) A person or entity shall not provide the operation of a voice recognition feature within this state without prominently informing, during the initial setup or installation of a connected television or smart speaker device, either the user or the person designated by the user to perform the initial setup or installation of the connected television or smart speaker device. device of both of the following:
(1) That the connected television or smart speaker device contains a voice recognition feature.
(2) What actions or commands will activate the voice recognition feature to record or transcribe audio.
(b) A recording or transcription collected or retained through the operation of a voice recognition feature by the manufacturer of a connected television or smart speaker device, including, but not limited to, the operation of an accessible user interface for people with disabilities, if the recording or transcription qualifies as personal information or is not deidentified, shall not be:
(1) Used for any advertising purpose.
(2) Shared with, or sold to, a third party, unless the user has provided affirmative written consent.
(3) Retained electronically, unless the user opts in to having that recording retained by the manufacturer either during installation or at a later time in the device settings.
(c) Notwithstanding paragraph (2) of subdivision (b), a manufacturer may share information with a third party without affirmative consent to the extent sharing that information is necessary to execute a function or provide a service specifically requested by the user, provided the third party does not use that information for any purpose other than to facilitate the execution of that function or provision of that service.
(d) If a user has provided affirmative consent for the sharing or sale of a recording or transcription as provided in paragraph (2) of subdivision (b), the manufacturer shall provide the user with the option to revoke that consent at any time in a manner reasonably accessible to the user.
(e) If a user has declined to provide affirmative consent for the sharing or sale of a recording or transcription as provided in paragraph (2) of subdivision (b), the person or entity seeking consent shall not request that affirmative consent for a period of at least 12 months after the user has declined to provide that affirmative consent.
(f) If a person or entity providing the operation of a device with a voice recognition feature within this state retains voice recordings that qualify as personal information or are not deidentified, that person or entity shall provide users with both of the following:
(1) An interface to review and delete those voice recordings. The interface shall be easily accessible and the user’s rights with respect to these recordings shall be clearly communicated to the user.
(2) The ability to delete those voice recordings automatically.
(g) (1) If a person or entity providing the operation of a voice recognition feature that can be activated by a voice command determines that the voice recognition feature was incorrectly activated, the person or entity shall not use the associated audio recording for any purpose, except as specified in paragraph (2).
(2) A person or entity providing the operation of a voice recognition feature that can be activated by a voice command may use an audio recording associated with an incorrect activation of a voice recognition feature to improve the accuracy of the voice recognition feature, provided that the user has provided affirmative consent for the use of the audio recording for that purpose.

(c)

(h) A person or entity shall not compel a manufacturer or other entity providing the operation of a voice recognition feature to build specific features for the purpose of allowing an investigative or law enforcement officer to monitor communications through that feature.

(d)

(i) A manufacturer shall not be liable for functionality provided by applications that the user chooses to use in the cloud or are downloaded and installed by a user, unless the manufacturer collects, controls, or has access to any personal information collected or elicited by the applications.

(e)

(j) This chapter shall not apply to any product or service provided by a company covered under Section 637.5 of the Penal Code.

(f)

(k) This chapter shall not apply to a product or service used only to record information described in subdivision (c) of Section 1798.145 of the Civil Code.

(g)

(l) This chapter shall not apply to any device regulated by the United States Food and Drug Administration.

SEC. 4.

 Section 22948.21 of the Business and Professions Code is amended to read:

22948.21.
 For purposes of this chapter, the following definitions shall apply:

(a)“Affirmative written consent” means that a manufacturer of a connected television or smart speaker device provided the following disclosure to a user during installation of a device, separate from the device terms of use, and received authorization from the user pursuant to the Electronic Signatures in Global and National Commerce Act (15 U.S.C. 7001 et seq.) and the Uniform Electronic Transactions Act (Title 2.5 (commencing with Section 1633.1) of Part 2 of Division 3 of the Civil Code):

This device may be used to process and retain user recordings and transcriptions of spoken words. Those recordings may be analyzed and shared with third parties by the manufacturer and its employees for the purpose of improving the device. Please indicate whether or not you give your consent for the device to be used in this way. This consent is not required to use the basic functions of this device.

I authorize [manufacturer name] to share my recordings, and I understand that the recordings may be analyzed and shared with third parties by the manufacturer and its employees.

I do not authorize [manufacturer name] to share my recordings and I do not want to have access to the enhanced smart features of this device.

(a) “Affirmative consent” means that a manufacturer of a connected television or smart speaker device has done all of the following:
(1) Clearly and conspicuously disclosed to the user, separate from the device terms of use, all of the following to the extent applicable:
(A) The device may be used to process and retain user recordings.
(B) The recordings described in subparagraph (A) may be analyzed or shared with third parties.
(C) The device may be used to process and retain transcriptions of spoken words.
(D) The transcriptions described in subparagraph (C) may be analyzed or shared with third parties.
(2) Clearly and conspicuously disclosed to the user, separate from the device terms of use, the extent to which the device can operate in the absence of consent for each practice described in the disclosure required by paragraph (1).
(3) Received a freely given, specific, informed, and unambiguous indication of the user’s wishes by which the user, including by a statement or by a clear affirmative action, signifies agreement to the processing of personal information relating to the user for each practice described in the disclosure required by paragraph (1). The following shall not satisfy the requirements of this paragraph:
(A) Acceptance of a general or broad terms of use, or similar document, that contains descriptions of personal information processing along with other, unrelated information.
(B) Hovering over, muting, pausing, or closing a given piece of content.
(C) Agreement obtained through the use of dark patterns.
(b) “Cloud computing storage service” has the same definition as the term is defined by the National Institute of Standards and Technology Special Publication 800-145, or a successor publication, and includes the service and deployment models referenced therein.
(c) “Connected television” means a video device designed for home use to receive television signals and reproduce them on an integrated, physical screen display that exceeds 12 inches, except that this term shall not include a personal computer, portable device, or a separate device that connects physically or wirelessly to a television, including, but not limited to, a set-top box, video game console, or digital video recorder.
(d) “Dark pattern” means a user interface designed or manipulated with the substantial effect of subverting or impairing user autonomy, decision-making, or choice.

(d)

(e) “Deidentified” has the same meaning as set forth in Section 1798.140 of the Civil Code.

(e)

(f) “Personal information” has the same meaning as set forth in Section 1798.140 of the Civil Code.

(f)

(g) “Retained” means saving or storing, or both saving and storing, voice recorded data longer than the minimum time necessary to complete a requested command by the user.

(g)

(h) (1) “Smart speaker device” means a speaker and voice command device offered for sale in this state with an integrated virtual assistant connected to a cloud computing storage service that uses hands-free verbal activation.
(2) A smart speaker device does not include a cellular telephone, a tablet, a laptop computer with mobile data access, a pager, or a motor vehicle, as defined in Section 415 of the Vehicle Code, or any speaker or device associated with, or connected to, a vehicle.

(h)

(i) “Third party” has the same meaning as set forth in Section 1798.140 of the Civil Code.

(i)

(j) (1) “User” means a person who originally purchases, leases, or takes ownership of a connected television or smart speaker device or another person designated by the user to perform the initial setup or installation of the connected television or smart speaker device.
(2) A person who is incidentally recorded when a voice recognition feature is activated by a user shall not be deemed to be a user.

(j)

(k) “Voice recognition feature” means the function of a connected television or smart speaker device with a voice recognition feature that allows the collection, recording, storage, analysis, transmission, interpretation, or other use of spoken words or other sounds, except that this term shall not include spoken words or other sounds that are not recorded, retained, or transmitted beyond the connected television or smart speaker device.

(k)

(l) “Voice recorded data” means audio recordings or transcriptions of those recordings collected through the operation of a voice recognition feature by the manufacturer of a connected television or smart speaker device.
(m) This section shall remain in effect only until January 1, 2023, and as of that date is repealed.

SEC. 5.

 Section 22948.21 is added to the Business and Professions Code, to read:

22948.21.
 For purposes of this chapter, the following definitions shall apply:
(a) “Affirmative consent” means that a manufacturer of a connected television or smart speaker device has done all of the following:
(1) Clearly and conspicuously disclosed to the user, separate from the device terms of use, all of the following to the extent applicable:
(A) The device may be used to process and retain user recordings.
(B) The recordings described in subparagraph (A) may be analyzed or shared with third parties.
(C) The device may be used to process and retain transcriptions of spoken words.
(D) The transcriptions described in subparagraph (C) may be analyzed or shared with third parties.
(2) Clearly and conspicuously disclosed to the user, separate from the device terms of use, the extent to which the device can operate in the absence of consent for each practice described in the disclosure required by paragraph (1).
(3) Received consent, as defined in Section 1798.140 of the Civil Code, for each practice described in the disclosure required by paragraph (1).
(b) “Cloud computing storage service” has the same definition as the term is defined by the National Institute of Standards and Technology Special Publication 800-145, or a successor publication, and includes the service and deployment models referenced therein.
(c) “Connected television” means a video device designed for home use to receive television signals and reproduce them on an integrated, physical screen display that exceeds 12 inches, except that this term shall not include a personal computer, portable device, or a separate device that connects physically or wirelessly to a television, including, but not limited to, a set-top box, video game console, or digital video recorder.
(d) “Deidentified” has the same meaning as set forth in Section 1798.140 of the Civil Code.
(e) “Personal information” has the same meaning as set forth in Section 1798.140 of the Civil Code.
(f) “Retained” means saving or storing, or both saving and storing, voice recorded data longer than the minimum time necessary to complete a requested command by the user.
(g) (1) “Smart speaker device” means a speaker and voice command device offered for sale in this state with an integrated virtual assistant connected to a cloud computing storage service that uses hands-free verbal activation.
(2) A smart speaker device does not include a cellular telephone, a tablet, a laptop computer with mobile data access, a pager, or a motor vehicle, as defined in Section 415 of the Vehicle Code, or any speaker or device associated with, or connected to, a vehicle.
(h) “Third party” has the same meaning as set forth in Section 1798.140 of the Civil Code.
(i) (1) “User” means a person who originally purchases, leases, or takes ownership of a connected television or smart speaker device or another person designated by the user to perform the initial setup or installation of the connected television or smart speaker device.
(2) A person who is incidentally recorded when a voice recognition feature is activated by a user shall not be deemed to be a user.
(j) “Voice recognition feature” means the function of a connected television or smart speaker device with a voice recognition feature that allows the collection, recording, storage, analysis, transmission, interpretation, or other use of spoken words or other sounds, except that this term shall not include spoken words or other sounds that are not recorded, retained, or transmitted beyond the connected television or smart speaker device.
(k) “Voice recorded data” means audio recordings or transcriptions of those recordings collected through the operation of a voice recognition feature by the manufacturer of a connected television or smart speaker device.
(l) This section shall become operative on January 1, 2023.

SEC. 5.SEC. 6.

 Section 22948.23 of the Business and Professions Code is amended to read:

22948.23.
 (a) Actions for relief pursuant to this chapter may be prosecuted exclusively in a court of competent jurisdiction in a civil action brought in the name of the people of the State of California by the Attorney General or by any district attorney. This chapter shall not be deemed to create a private right of action or limit any existing private right of action.
(b) A court may enjoin a person who knowingly engages, has engaged, or proposes to engage, in a violation of this chapter. The court may make any orders or judgments as may be necessary to prevent a violation of this chapter.
(c) A person who knowingly engages, has engaged, or proposes to engage, in a violation of this chapter shall be liable for a civil penalty not to exceed two thousand five hundred dollars ($2,500) for each connected television or smart speaker device sold or leased in violation of this chapter. If the action is brought by the Attorney General, the penalty shall be deposited into the General Fund. If the action is brought by a district attorney, the penalty shall be paid to the treasurer of the county in which the judgment was entered.