Amended  IN  Assembly  April 19, 2018
Amended  IN  Assembly  February 28, 2018

CALIFORNIA LEGISLATURE— 2017–2018 REGULAR SESSION

Assembly Bill No. 1950

Introduced by Assembly Member Levine

January 29, 2018

An act to add Article 10 (commencing with Section 17610) to Chapter 1 of Part 3 of Division 7 of the Business and Professions Code, and to add Part 5.6 (commencing with Section 7110) to Division 4 of the Civil Code, amend Section 22575 of the Business and Professions Code, relating to Internet Web sites. consumers.


LEGISLATIVE COUNSEL'S DIGEST


AB 1950, as amended, Levine. Internet Web sites: social media: advertising: accounts. Consumers: Internet privacy.
Existing law requires an operator of a commercial Web site or online service that collects personally identifiable information through the Internet about individual consumers residing in California who use or visit its commercial Web site or online service to conspicuously post its privacy policy on its Web site or to make that policy available, as specified, and to comply with that policy. Existing law requires the privacy policy to, among other things, disclose whether other parties may collect personally identifiable information about an individual consumer’s online activities over time and across different Web sites when a consumer uses the operator’s Web site or service.
This bill would require the privacy policy also to disclose that the operator utilizes bots for the dissemination of information and that bots are software that can execute commands, reply to messages, gather information, or perform routine tasks such as online searches, either automatically or with minimal human intervention.

Existing law prohibits a person, firm, corporation or association, or any employee thereof, from making or disseminating in any advertising device, or in any manner or means whatever, including over the Internet, any statement concerning real or personal property or services that is untrue or misleading, as specified.

This bill would prohibit an operator of a social media Internet Web site with a physical presence in California from engaging in the sale of advertising with a computer software account or user that performs an automated task, and that is not verified by the operator as being controlled by a natural person. The bill would require an operator of a social media Internet Web site with a physical presence in California to verify whether an account or profile it hosts on its Internet Web site is being controlled by a computer software account or user that performs an automated task, and if so, to prominently indicate that to users of its site. The bill would require an operator of a social media Internet Web site with a physical presence in California to require an account or profile it hosts on its Internet Web site that it identifies as being controlled by a computer software account or user that performs an automated task to be linked to a natural person.

Vote: MAJORITY   Appropriation: NO   Fiscal Committee: NO   Local Program: NO  

The people of the State of California do enact as follows:


SECTION 1.

 Section 22575 of the Business and Professions Code is amended to read:

22575.
 (a) An operator of a commercial Web site or online service that collects personally identifiable information through the Internet about individual consumers residing in California who use or visit its commercial Web site or online service shall conspicuously post its privacy policy on its Web site, or in the case of an operator of an online service, make that policy available in accordance with paragraph (5) of subdivision (b) of Section 22577. An operator shall be in violation of this subdivision only if the operator fails to post its policy within 30 days after being notified of noncompliance.
(b) The privacy policy required by subdivision (a) shall do all of the following:
(1) Identify the categories of personally identifiable information that the operator collects through the Web site or online service about individual consumers who use or visit its commercial Web site or online service and the categories of third-party persons or entities with whom the operator may share that personally identifiable information.
(2) If the operator maintains a process for an individual consumer who uses or visits its commercial Web site or online service to review and request changes to any of his or her personally identifiable information that is collected through the Web site or online service, provide a description of that process.
(3) Describe the process by which the operator notifies consumers who use or visit its commercial Web site or online service of material changes to the operator’s privacy policy for that Web site or online service.
(4) Identify its effective date.
(5) Disclose how the operator responds to Web browser “do not track” signals or other mechanisms that provide consumers the ability to exercise choice regarding the collection of personally identifiable information about an individual consumer’s online activities over time and across third-party Web sites or online services, if the operator engages in that collection.
(6) Disclose whether other parties may collect personally identifiable information about an individual consumer’s online activities over time and across different Web sites when a consumer uses the operator’s Web site or service.
(7) Disclose whether the operator utilizes bots for the dissemination of information, and that bots are software that, for purposes of this section, can execute commands, reply to messages, gather information, or perform routine tasks such as online searches, either automatically or with minimal human intervention.

(7)

(8) An operator may satisfy the requirement of paragraph (5) by providing a clear and conspicuous hyperlink in the operator’s privacy policy to an online location containing a description, including the effects, of any program or protocol the operator follows that offers the consumer that choice.

SECTION 1.

(a)The Legislature hereby finds and declares that hackers and others now have the ability to sell advertisements on Web sites using computer programs called “bots” that can mimic human behavior to make it appear as though real people are visiting the Web sites and clicking on advertisements.

(b)It is the intent of the Legislature to establish new standards to detect and prevent fraudulent or deceptive advertisements that are placed by bots instead of through direct contact and negotiation with natural persons.

SEC. 2.Article 10 (commencing with Section 17610) is added to Chapter 1 of Part 3 of Division 7 of the Business and Professions Code, to read:
10.Internet Advertising
17610.

(a)An operator of a social media Internet Web site with a physical presence in California shall not engage in the sale of advertising with a computer software account or user that performs an automated task, and that is not verified by the operator as being controlled by a natural person.

(b)As used in this section, “social media” means an electronic service or account, or electronic content, including, but not limited to, videos, still photographs, blogs, video blogs, podcasts, instant and text messages, email, online services or accounts, or Internet Web site profiles or locations.

SEC. 3.Part 5.6 (commencing with Section 7110) is added to Division 4 of the Civil Code, to read:
5.6.Social Media Internet Web Sites
7110.

(a)As used in this section, “social media” means an electronic service or account, or electronic content, including, but not limited to, videos, still photographs, blogs, video blogs, podcasts, instant and text messages, email, online services or accounts, or Internet Web site profiles or locations.

(b)An operator of a social media Internet Web site with a physical presence in California shall verify whether an account or profile it hosts on its Internet Web site is being controlled by a computer software account or user that performs an automated task, and if so, prominently indicate that to users of its Internet Web site.

(c)An operator of a social media Internet Web site with a physical presence in California shall require an account or profile it hosts on its Internet Web site that the operator identifies, pursuant to subdivision (a), to be controlled by a computer software account or user that performs an automated task to be linked to a natural person.