TITLE 1.81.49. Health and Location Data Privacy [1798.99.90. - 1798.99.93.]

Cal. Civil Code - CIV 4.

in effect

Cal. Civil Code - CIV § 1798.99.90. Section 1798.99.90.

For purposes of this title, the following definitions apply: (a) “Collect,” “collected,” or “collection” means buying, renting, gathering, obtaining, receiving, or accessing any personal information pertaining to a natural person by any means. This includes receiving information from the natural person, either actively or passively, or by observing the natural person’s behavior. (b) “Family planning center” means a facility categorized as a family planning center by the North American Industry Classification System adopted by the United States Census Bureau, including, but not limited to, a clinic or center that provides reproductive health care services as defined in Section 1798.300. (c) “Geofence” means any technology that enables spatial or location detection to establish a virtual boundary around, and detect an individual’s presence within, a “precise geolocation” as defined in subdivision (w) of Section 1798.140. (d) “Health care services” means any service provided to a natural person of a medical, surgical, psychiatric, therapeutic, diagnostic, mental health, behavioral health, preventative, rehabilitative, supportive, consultative, referral, or prescribing nature. (e) “Person” means a natural person, association, proprietorship, corporation, trust, foundation, partnership, or any other organization or group of people acting in concert. (f) “Personal information” has the same definition as that term is defined in subdivision (v) of Section 1798.140, except as applied to all natural persons and not limited to consumers and households, as those terms are defined in subdivisions (i) and (q), respectively, of that section. (g) “Precise geolocation” means a geographic area that is equal to or less than the area of a circle with a radius of 1,850 feet as derived from a device that is used or intended to be used to locate a person. If the geographic scope of the term “precise geolocation” as defined in Section 1798.140 is expanded beyond 1,850 feet, then that larger scope shall apply to this definition of precise geolocation. (h) “Research” means systematic investigation, including research development, testing, and evaluation, that has as its primary purpose the development of, or contribution to, generalizable knowledge. (i) “Sell,” “selling,” “sale,” or “sold” means selling, renting, releasing, disclosing, disseminating, making available, transferring, or otherwise communicating orally, in writing, or by electronic or other means, a natural person’s personal information by another person to a third party for monetary or other valuable consideration. (j) “Share,” “shared,” or “sharing” means sharing, renting, releasing, disclosing, disseminating, making available, transferring, or otherwise communicating orally, in writing, or by electronic or other means, a natural person’s personal information by another person to a third party, whether or not for monetary or other valuable consideration.

Cal. Civil Code - CIV § 1798.99.91. Section 1798.99.91.

(a) It shall be unlawful to collect, use, disclose, sell, share, or retain the personal information of a natural person who is physically located at, or within a precise geolocation of, a family planning center, except as specified in subdivision (b) or as otherwise provided by law or in a collective bargaining agreement. (b) Notwithstanding subdivision (a), it is permissible to collect or use the personal information of a natural person who is physically located at, or within a precise geolocation of, a family planning center, but only as necessary to perform the services or provide the goods requested by the natural person. All other prohibitions under subdivision (a) shall continue to apply. (c) (1) An aggrieved person or entity, including a family planning center, may institute and prosecute a civil action against any person who violates this section for injunctive and monetary relief and attorney’s fees within three years of discovery of the violation. (2) If the court finds for the petitioner in an action authorized by paragraph (1), recovery shall be in the amount of three times the amount of actual damages and any other expenses, costs, or reasonable attorney’s fees incurred in connection with the litigation. (d) (1) This section does not apply to a provider of health care, a health care service plan, or contractor, as those terms are defined in Section 56.05 or to a covered entity or its business associate, as defined in Section 160.103 of Title 45 of the Code of Federal Regulations. (2) In order to qualify for this exemption, a contractor or business associate must be contractually obligated to comply with all applicable state and federal privacy laws. (e) (1) Nothing in this section shall be construed to alter applicable law, including pursuant to Section 3010 of the Penal Code, regarding use by a law enforcement agency of personal information, including geolocation information, generated by an electronic monitoring device. (2) For purposes of this section, “law enforcement agency” means any department or agency of the state or any local government, special district, or other political subdivision thereof that employs any peace officer, as described in Chapter 4.5 (commencing with Section 830) of Title 3 of Part 2 of the Penal Code.

Cal. Civil Code - CIV § 1798.99.92. Section 1798.99.92.

(a) Except as provided in subdivision (f), it shall be unlawful to geofence an entity that provides in-person health care services in California for any of the following purposes: (1) To identify or track a person seeking, receiving, or providing health care services. (2) To collect personal information from a person seeking, receiving, or providing health care services. (3) To send notifications to a person related to their personal information or health care services. (4) To send advertisements to a person related to the person’s personal information or health care services. (b) It shall be unlawful to sell personal information to, or share personal information with, a third party for the use of such information to violate subdivision (a). A statement signed under penalty of perjury, pursuant to Section 2015.5 of the Code of Civil Procedure, by a natural person authorized to enter into agreements on behalf of the third party that the personal information will not be used for these purposes shall be prima facie evidence that the personal information was not sold or shared in violation of this subdivision. (c) Except as provided in subdivision (f), it shall be unlawful to use personal information obtained in violation of subdivision (a) or (b). (d) (1) Any person that violates this section shall be subject to an injunction and liable for a civil penalty of twenty-five thousand dollars ($25,000) for each violation, which shall be assessed and recovered in a civil action brought in the name of the people of the State of California by the Attorney General. The court may consider the good faith cooperation of the entity or person in determining the amount of the civil penalty. (2) Any civil penalty recovered by an action brought by the Attorney General for a violation of this section, and the proceeds of any settlement of any said action, shall be deposited in the California Reproductive Justice and Freedom Fund established pursuant to Section 140 of the Health and Safety Code. (e) This section shall be implemented consistent with state and federal law. (f) (1) (A) This section does not prohibit any person that owns, operates, manages, or otherwise provides services to an in-person health care entity from geofencing the entity’s own location to provide necessary health care services, including the use of location-based alarm devices to monitor newborns and memory-impaired individuals. (B) This section does not prohibit any person that provides reproductive health care services, as defined in Section 1798.300, from utilizing geofencing for the purpose of providing security services to protect patients, staff, or property. (2) Nothing in this section shall exempt any person from complying with any of the following: (A) A lawfully executed search warrant. (B) A lawful subpoena issued pursuant to existing California law. (C) Law enforcement if law enforcement, in good faith, believes that an emergency involving danger of death or serious physical injury to any person requires access to such geofencing data. For purposes of this subparagraph, accessing, procuring, or searching for services regarding contraception, pregnancy care, and perinatal care, including, but not limited to, abortion services, shall not constitute being at risk or danger of death or serious physical injury. (3) Nothing in this section abrogates or limits the requirements of the Electronic Communications Privacy Act (Chapter 3.6 (commencing with Section 1546) of Title 12 of Part 2 of the Penal Code). (4) Nothing in this section shall apply to geofencing activities conducted solely for research purposes by an investigator within an institution that holds an assurance with the federal Department of Health and Human Services pursuant to Part 46 (commencing with Section 46.101) of Title 45 of the Code of Federal Regulations and who obtains informed consent in the method and manner required by those regulations. (5) (A) This section does not prohibit geofencing activities conducted by a labor organization, as defined in Section 1117 of the Labor Code, or an employee organization, as defined in subdivision (a) of Section 3501 of, subdivision (a) of Section 3513 of, or subdivision (f) of Section 3562 of, the Government Code, if geofencing does not result in the labor union’s collection of names or personal information without the express consent of an individual and is for activities concerning workplace conditions, worker or patient safety, labor disputes, or organizing. (B) A third party vendor, including, but not limited to, a social media platform, that collects personal information from a labor organization or employee organization pursuant to subparagraph (A) shall be prohibited from selling, using, or sharing that personal information for any purpose other than the activities described in subparagraph (A).

Cal. Civil Code - CIV § 1798.99.93. Section 1798.99.93.

(a) Research records, in a personally identifying form, developed or acquired by a person in the course of conducting research relating to anyone seeking or obtaining health care services, or relating to personal information, shall be subject to the restrictions on release set forth in this section. (b) Research records, in a personally identifying form, developed or acquired by a person in the course of conducting research relating to anyone seeking or obtaining health care services, or relating to personal information, shall not be released in response to a subpoena or request if that subpoena or request is based on either another state’s laws that interfere with a person’s rights under the Reproductive Privacy Act (Article 2.5 (commencing with Section 123460) of Chapter 2 of Part 2 of Division 106 of the Health and Safety Code) or a foreign penal civil action, as defined in Section 2029.200 of the Code of Civil Procedure. (c) Research records, in a personally identifying form, developed or acquired by a person in the course of conducting research relating to anyone seeking or obtaining health care services, or relating to personal information, shall not be released to law enforcement for either of the following purposes, unless that release is pursuant to a subpoena not otherwise prohibited by subdivision (b): (1) Enforcement of another state’s law that interferes with a person’s rights under the Reproductive Privacy Act (Article 2.5 (commencing with Section 123460) of Chapter 2 of Part 2 of Division 106 of the Health and Safety Code). (2) Enforcement of a foreign penal civil action, as defined in Section 2029.200 of the Code of Civil Procedure.

Source: CA Legislative Counsel Bulk DataURL: https://downloads.leginfo.legislature.ca.gov/pubinfo_2025.zipFetched: 6/27/2026