AMENDED IN SENATE AUGUST 21, 2017

AMENDED IN SENATE JUNE 19, 2017

AMENDED IN ASSEMBLY APRIL 27, 2017
california legislature—2017–18 regular session

ASSEMBLY BILL No. 375

Introduced by Assembly Member Chau

February 9, 2017

An act to add Chapter 36 21.7 (commencing with Section 22949.1)

22550) to Division 8 of the Business and Professions Code, relating to
customer privacy.

legislative counsel’s digest

AB 375, as amended, Chau. Internet Communications service
providers: customer privacy.
Existing law requires an operator of a commercial Internet Web site
or online service that collects personally identifiable information through
the Internet about individual consumers residing in California who use
or visit the commercial Internet Web site or online service to
conspicuously post, or make available, its privacy policy, as specified.
Under existing law, an operator violates this provision only if the
operator fails to post its policy within 30 days after being notified of
noncompliance. Existing law requires, among other things, that the
privacy policy identify the categories of personally identifiable
information that the operator collects about individual consumers and
the categories of 3rd-party persons or entities with whom the operator
may share that information.

96
AB 375 —2—

Existing law prohibits telephone and telegraph corporations from

releasing certain information regarding residential subscribers without
their written consent, except in specified circumstances.
Existing law requires a business that owns, licenses, or maintains
personal information about a California resident to implement and
maintain reasonable security procedures and practices appropriate to
the nature of the information in order to protect the personal information
from unauthorized access, destruction, use, modification, or disclosure.
Existing law requires a person or business that conducts business in
California, and that owns or licenses computerized data that includes
personal information, to disclose a breach of the security of the system
to specified residents of California, as specified. Existing law requires
that disclosure to be made in the most expedient time possible and
without unreasonable delay, consistent with the legitimate needs of law
enforcement or any measures necessary to determine the scope of the
breach and restore the reasonable integrity of the data system.
This bill would enact the California Broadband Internet Privacy Act.
The bill act would prohibit an Internet service provider from using,
disclosing, selling, or permitting access to customer personal
information, except as provided in that act. The bill would authorize a
customer to give prior opt-in consent, which may be revoked by the
customer at any time, to an Internet service provider to use, disclose,
sell, or permit access to that customer’s personal information. The bill
would prohibit an Internet service provider from refusing to serve or
to limit service to a customer who does not provide consent or charging
a customer a penalty or offering a customer a discount or another benefit
based on the customer’s decision to provide consent. require
communications providers, defined as providers that offer
telecommunications in California for a fee directly to the public, as
specified, to notify their customers of their privacy policies. The act
would, except as provided, prohibit those providers from using,
disclosing, or permitting access to customer proprietary information,
as defined. The act would require those providers to take reasonable
measures to protect customer proprietary information from unauthorized
use, disclosure, or access, considering the nature and scope of the
provider’s activities, the sensitivity of the data it collects, the size of the
provider, and technical feasibility. The act would require those providers
to notify an affected customer of any breach of the security of the service
that may expose the customer’s proprietary information, as specified,
and to maintain a record of any breaches and related notifications made

96
 —3— AB 375

to customers, unless the provider can reasonably determine that no

harm to customers is reasonably likely to occur as a result of the breach.
The act would prohibit a broadband Internet access service provider,
as defined, from refusing to provide broadband Internet access service,
or in any way limiting that service, to a customer who does not waive
his or her privacy rights guaranteed by law or regulation, and would
prohibit charging a customer a penalty, penalizing a customer in any
way, or offering a customer a discount or another benefit, as a direct
or indirect consequence of a customer’s decision to, or refusal to, waive
his or her privacy rights guaranteed by law or regulation.
The bill, however, would authorize an Internet service provider to
use, disclose, or permit access to customer personal information, without
customer approval, for specified limited purposes, unless otherwise
prohibited by state law. These purposes would include to comply with
other laws or an administrative or court order, to bill and collect for
Internet access services, and to provide location information concerning
a customer. The bill would require an Internet service provider to
maintain reasonable security procedures to protect customers’ personal
information. The bill would specify that its requirements apply to
Internet service providers operating within California when providing
Internet access services to customers who are residents of and physically
located in California.
Vote: majority. Appropriation: no. Fiscal committee: no.
State-mandated local program: no.

The people of the State of California do enact as follows:

line 1 SECTION 1. Chapter 36 21.7 (commencing with Section

line 2 22949.1) 22550) is added to Division 8 of the Business and
line 3 Professions Code, to read:
line 4
line 5 Chapter 36.21.7. California Broadband Internet Privacy
line 6 Act
line 7
line 8 22949.1.
line 9 22550. This chapter shall be known, and may be cited, as the
line 10 California Broadband Internet Privacy Act.
line 11 22949.2.
line 12 22550.5. It is the intent of the Legislature in enacting this
line 13 chapter to give consumers greater control over their personal

96
 AB 375 —4—

line 1 information when accessing the Internet through an a broadband

line 2 Internet access service provider and thereby better protect their
line 3 own privacy and autonomy. It is also the intent of the Legislature
line 4 that the consumer protections set forth in this chapter be interpreted
line 5 broadly and any exceptions interpreted narrowly in order to
line 6 maximize individual privacy and autonomy.
line 7 22949.3. For purposes of this chapter, the following terms have
line 8 the following meanings:
line 9 (a)  “Aggregate customer information” means collective data
line 10 that relates to a group or category of customers, from which
line 11 individual customer identities and characteristics have been
line 12 removed, that is not linked or reasonably linkable to any individual
line 13 person, household, or device. “Aggregate customer information”
line 14 does not mean one or more individual customer records that have
line 15 been deidentified.
line 16 (b)  “Customer” means a current or former subscriber to the
line 17 Internet access service, or an applicant for Internet access service.
line 18 (c)  “Customer personal information” means information
line 19 collected from or about an individual customer or user of the
line 20 customer’s subscription that is made available to the Internet
line 21 service provider by a customer or user of the customer’s
line 22 subscription solely by virtue of the provider-customer relationship,
line 23 including:
line 24 (1)  Name and billing information.
line 25 (2)  Government-issued identifiers, including social security
line 26 number.
line 27 (3)  Information that would permit the physical or online
line 28 contacting of an individual, such as physical address, email address,
line 29 phone number, or IP address.
line 30 (4)  Demographic information, such as date of birth, age, gender,
line 31 race, ethnicity, nationality, religion, or sexual orientation.
line 32 (5)  Financial information.
line 33 (6)  Health information.
line 34 (7)  Information pertaining to minors.
line 35 (8)  Geolocation information.
line 36 (9)  Information from the use of the service, such as Web
line37 browsing history, application usage history, content of
line 38 communications, and origin and destination Internet Protocol (IP)
line 39 addresses of all traffic.

96
 —5— AB 375

line 1 (10)  Device identifiers, such as media access control (MAC)

line 2 address or Internet mobile equipment identity (IMEI).
line 3 (11)  Information concerning a customer or user of the
line 4 customer’s subscription that is collected or made available and is
line 5 maintained in personally identifiable form.
line 6 (d)  “Internet access service” means a mass-market retail service
line 7 by wire or radio that provides the capability to transmit data to and
line 8 receive data from all or substantially all Internet endpoints,
line 9 including any capabilities that are incidental to and enable the
line 10 operation of the communications service, but excluding dial-up
line 11 Internet access service. “Internet access service” also encompasses
line 12 any service that the Federal Communications Commission or the
line 13 Public Utilities Commission finds to be providing a functional
line 14 equivalent to the service described in this subdivision.
line 15 (e)  “Internet service provider” means a person or entity engaged
line 16 in the provision of Internet access service, but only to the extent
line 17 that the person or entity is providing Internet access service.
line 18 22949.4. (a)  An Internet service provider shall not use,
line 19 disclose, sell, or permit access to customer personal information,
line 20 except as provided in this chapter.
line 21 (b)  (1)  An Internet service provider may use, disclose, sell, or
line 22 permit access to customer personal information if the customer
line 23 gives the Internet service provider prior opt-in consent, which may
line 24 be revoked by the customer at any time. The mechanism for
line 25 requesting and revoking consent under this subdivision shall be
line 26 clear and conspicuous, as defined in subdivision (c) of Section
line 27 17601, not misleading, in the language primarily used to conduct
line 28 business with the customer, and made available to the customer
line 29 at no additional cost. The mechanism shall also be persistently
line 30 available on or through the Internet service provider’s Internet
line 31 Web site, or mobile application if it provides one for account
line 32 management purposes. If the Internet service provider does not
line 33 have an Internet Web site, it shall provide a persistently available
line 34 mechanism by another means, such as a toll-free telephone number.
line 35 The customer’s grant, denial, or withdrawal of consent shall be
line 36 given effect promptly and remain in effect until the customer
line 37 revokes or limits the grant, denial, or withdrawal of consent.
line 38 (2)  The request for consent shall disclose to the customer all of
line 39 the following:

96
 AB 375 —6—

line 1 (A)  The types of customer personal information for which the

line 2 Internet service provider is seeking customer approval to use,
line 3 disclose, sell, or permit access.
line 4 (B)  The purposes for which the customer personal information
line 5 will be used.
line 6 (C)  The categories of entities to which the Internet service
line 7 provider intends to disclose, sell, or permit access to the customer
line 8 personal information.
line 9 (c)  An Internet service provider shall not do either of the
line 10 following:
line 11 (1)  Refuse to serve a customer, or in any way limit services to
line 12 a customer, who does not provide consent under subdivision (b).
line 13 (2)  Charge a customer a penalty, or penalize a customer in any
line 14 way, or offer a customer a discount or another benefit based on
line 15 the customer’s decision to provide or not provide consent under
line 16 subdivision (b).
line 17 (d)  An Internet service provider shall disclose the customer
line 18 personal information of the customer upon affirmative written
line 19 request by the customer, to any person designated by the customer.
line 20 22949.5. (a)  An Internet service provider may use, disclose,
line 21 or permit access to customer personal information without customer
line 22 consent, but only to the extent necessary to achieve the stated
line 23 purpose, in the following circumstances, unless otherwise
line 24 prohibited by state law:
line 25 (1)  To provide the Internet access service from which the
line 26 information is derived, or services necessary to the provision of
line 27 that service.
line 28 (2)  To comply with legal process or other laws, court orders,
line 29 or administrative orders.
line 30 (3)  To initiate, render, bill for, and collect for Internet access
line 31 service.
line 32 (4)  To protect the rights or property of the Internet service
line 33 provider, or to protect customers of those services and other carriers
line 34 from fraudulent, abusive, or unlawful use of, or subscription to,
line 35 those services.
line 36 (5)  To provide location information concerning the customer
line 37 as follows:
line 38 (A)  To a public safety answering point, emergency medical
line 39 service provider, or emergency dispatch provider, public safety,
line 40 fire service, or law enforcement official, or hospital emergency or

96
 —7— AB 375

line 1 trauma care facility, in order to respond to the customer’s request

line 2 for emergency services.
line 3 (B)  To inform the customer’s legal guardian, members of the
line 4 customer’s family, or a person reasonably believed by the Internet
line 5 service provider, to be a close personal friend of the customer, of
line 6 the customer’s location in an emergency situation that involves
line 7 the risk of death or life-threatening harm.
line 8 (C)  To providers of information or database management
line 9 services solely for purposes of assisting in the delivery of
line 10 emergency services in response to an emergency.
line 11 (b)  Nothing in this chapter shall restrict an Internet service
line 12 provider from generating an aggregate customer information dataset
line 13 using customer personal information, or using, disclosing, selling,
line 14 or permitting access to the aggregate customer information dataset
line 15 it generated.
line 16 (c)  Unless otherwise prohibited by state law, an Internet service
line 17 provider may use, disclose, or permit access to customer personal
line18 information to advertise or market the provider’s
line 19 communications-related services to the customer, provided that
line 20 the customer may opt out of that use, disclosure, or access at any
line 21 time, and the customer is notified of the right to opt out in a manner
line 22 that is clear and conspicuous, as defined in subdivision (c) of
line 23 Section 17601, not misleading, in the language primarily used to
line 24 conduct business with the consumer, persistently available, and
line 25 made available to the customer at no additional cost.
line 26 22949.6. (a)  An Internet service provider shall implement and
line 27 maintain reasonable security procedures and practices appropriate
line 28 to the nature of the information to protect customer personal
line 29 information from unauthorized use, disclosure, access, destruction,
line 30 or modification.
line 31 (b)  An Internet service provider may employ any lawful security
line 32 measures that allow it to comply with the requirements set forth
line 33 in this section.
line 34 (c)  An Internet service provider shall not retain a customer’s
line 35 information for longer than is reasonably necessary to accomplish
line 36 the purposes for which the information was collected, unless the
line 37 information is aggregate customer information, or as otherwise
line 38 required by this chapter.
line 39 22551. For purposes of this chapter:

96
 AB 375 —8—

line 1 (a)  “Broadband Internet access service” means a mass market

line 2 retail service by wire or radio in California that provides the
line 3 capability to transmit data and to receive data from all or
line 4 substantially all Internet endpoints, including any capabilities that
line 5 are incidental to, and enable the operation of, the communications
line 6 service, but excluding dial-up Internet access service. The term
line 7 also encompasses any service that provides a functional equivalent
line 8 of the service described in this subdivision, or that is used to evade
line 9 the protections set forth in this chapter.
line 10 (b)  “Broadband Internet access service provider” means a
line 11 person engaged in the provision of broadband Internet access
line 12 service to a customer account located in California.
line 13 (c)  “Breach of security,” “breach,” and “data breach” mean
line 14 any instance in which a person, without authorization or exceeding
line 15 authorization, has gained access to, used, or disclosed customer
line 16 proprietary information.
line 17 (d)  “Call detail information” means information that pertains
line 18 to the transmission of specific telephone calls, including the
line 19 following:
line 20 (1)  For any call, its time, location, and duration.
line 21 (2)  For an outbound call, the telephone number called.
line 22 (3)  For an inbound call, the telephone number from which the
line 23 call was placed.
line 24 (e)  “Communications provider” or “provider” means any
line 25 provider of communications services in California, except that
line 26 this term does not include aggregators of communications services,
line 27 as defined in Section 226 of Title 47 of the United States Code.
line 28 For purposes of this chapter, the term “communications provider”
line 29 or “provider” shall include a person engaged in the provision of
line 30 VoIP service or broadband Internet access service.
line31 (f)  “Communications service” means the offering of
line 32 telecommunications in California for a fee directly to the public,
line 33 or to such classes of users as to be effectively available directly
line 34 to the public, regardless of the facilities used. For the purposes of
line 35 this chapter, the term “communications service” shall include
line 36 VoIP service and broadband Internet access service.
line 37 (g)  “Customer” means either of the following:
line 38 (1)  A current or former subscriber to communications service
line 39 in California.
line 40 (2)  An applicant for communications service in California.

96
 —9— AB 375

line 1 (h)  “Customer proprietary information” means any of the

line 2 following that a communications provider acquires in connection
line 3 with its provision of communications service:
line 4 (1)  Individually identifiable customer proprietary network
line 5 information.
line 6 (2)  Personally identifiable information.
line 7 (3)  Content of a communication.
line 8 (i)  (1)  “Customer proprietary network information” means
line 9 both of the following:
line 10 (A)  Information that relates to the quantity, technical
line 11 configuration, type, destination, location, and amount of use of a
line 12 communications service subscribed to by a customer of a
line 13 communications provider, and that is made available to the
line 14 provider by the customer solely by virtue of the provider-customer
line 15 relationship.
line 16 (B)  Information contained in the bills pertaining to telephone
line 17 exchange service or telephone toll service received by a customer
line 18 of a provider.
line 19 (2)  “Customer proprietary network information” does not
line 20 include subscriber list information.
line 21 (j)  “Interconnected Voice over Internet Protocol service” or
line 22 “VoIP service” means a service that does all of the following:
line 23 (1)  Enables real-time, two-way voice communications.
line 24 (2)  Requires a broadband connection from the user’s location.
line 25 (3)  Requires Internet protocol-compatible customer premises
line 26 equipment.
line 27 (4)  Permits users generally to receive calls that originate on
line 28 the public switched telephone network and to terminate calls to
line 29 the public switched telephone network.
line 30 (k)  “Material change” means any change that a customer,
line 31 acting reasonably under the circumstances, would consider
line 32 important to his or her decisions regarding his or her privacy,
line 33 including any change to information required by the privacy notice
line 34 described in Section 22552.
line 35 (l)  “Opt-in approval” means a method for obtaining customer
line 36 consent to use, disclose, or permit access to the customer’s
line 37 proprietary information. This approval method requires that the
line 38 communications provider obtain from the customer affirmative,
line 39 express consent allowing the requested usage, disclosure, or access
line 40 to the customer proprietary information after the customer is

96
 AB 375 — 10 —

line 1 provided appropriate notification of the provider’s request,

line 2 consistent with the requirements of this chapter.
line 3 (m)  “Opt-out approval” means a method for obtaining customer
line 4 consent to use, disclose, or permit access to the customer’s
line 5 proprietary information. Under this approval method, a customer
line 6 is deemed to have consented to the use or disclosure of, or access
line 7 to, the customer’s proprietary information if the customer has
line 8 failed to object to that use, disclosure, or access after the customer
line 9 is provided appropriate notification of the communications
line 10 provider’s request for consent, consistent with the requirements
line 11 of this chapter.
line 12 (n)  “Person” includes an individual, partnership, association,
line 13 joint-stock company, trust, or corporation.
line 14 (o)  “Personally identifiable information” means any information
line 15 that is linked or reasonably linkable to an individual or device.
line 16 (p)  “Sensitive customer proprietary information” includes all
line 17 of the following:
line 18 (1)  Financial information.
line 19 (2)  Health information.
line 20 (3)  Information pertaining to children.
line 21 (4)  Social security numbers.
line 22 (5)  Precise geolocation information.
line 23 (6)  Content of communications.
line 24 (7)  Call detail information.
line 25 (8)  Web browsing history, application usage history, and the
line 26 functional equivalents of either.
line 27 (q)  “Telecommunications” means the transmission, between or
line 28 among points specified by the user, of information of the user’s
line 29 choosing, without change in the form or content of the information
line 30 as sent and received.
line 31 22552. (a)  In addition to the requirements of Chapter 22
line32 (commencing with Section 22575), as applicable, a
line 33 communications provider shall notify its customers of its privacy
line 34 policies. The notice shall be clear and conspicuous, and in
line 35 language that is comprehensible and not misleading, and shall do
line 36 all of the following:
line 37 (1)  Specify and describe the types of customer proprietary
line 38 information that the provider collects by virtue of its provision of
line 39 communications service and how it uses that information.

96
 — 11 — AB 375

line 1 (2)  Specify and describe under what circumstances the provider

line 2 discloses or permits access to each type of customer proprietary
line 3 information that it collects.
line 4 (3)  Specify and describe the categories of entities to which the
line 5 provider discloses or permits access to customer proprietary
line 6 information and the purposes for which the customer proprietary
line 7 information will be used by each category of entities.
line 8 (4)  Specify and describe a customer’s opt-in approval and
line 9 opt-out approval rights with respect to his or her customer
line 10 proprietary information, including both of the following:
line 11 (A)  That a customer’s denial or withdrawal of approval to use,
line 12 disclose, or permit access to customer proprietary information
line 13 shall not affect the provision of any communications services of
line 14 which he or she is a customer.
line 15 (B)  That any grant, denial, or withdrawal of approval for the
line 16 use, disclosure, or permission of access to the customer proprietary
line 17 information is valid until the customer affirmatively revokes that
line 18 grant, denial, or withdrawal. The notice shall inform the customer
line 19 of his or her right to deny or withdraw access to the proprietary
line 20 information at any time.
line 21 (5)  Provide for access to a mechanism for a customer to grant,
line 22 deny, or withdraw approval for the provider to use, disclose, or
line 23 provide access to customer proprietary information as required
line 24 by Section 22553.
line 25 (6)  Be completely translated into a language other than English
line 26 if the provider transacts business with the customer in that
line 27 language.
line 28 (b)  Notice required under subdivision (a) shall be made pursuant
line 29 to both of the following requirements:
line 30 (1)  The provider shall make the notice to a prospective customer
line 31 at the point of sale, prior to the purchase of service, whether the
line 32 point of sale is in person, online, over the telephone, or via another
line 33 means.
line 34 (2)  The provider shall make the notice persistently available
line 35 through a clear and conspicuous link on the communications
line 36 provider’s homepage, the provider’s application if it provides one
line 37 for account management purposes, and any functional equivalent
line 38 to the provider’s homepage or application. If a provider does not
line 39 have an Internet Web site, it shall provide notice to a customer in
line 40 paper form or another format agreed upon by the customer.

96
 AB 375 — 12 —

line 1 (c)  A communications provider shall provide an existing

line 2 customer with advance notice of one or more material changes to
line 3 the provider’s privacy policies. The notice shall be clear and
line 4 conspicuous, in language that is comprehensible and not
line 5 misleading, and shall satisfy all of the following:
line 6 (1)  It shall be provided through email or another means of active
line 7 communication agreed upon by the customer.
line 8 (2)  It shall specify and describe both of the following:
line 9 (A)  The changes made to the provider’s privacy policies,
line 10 including any changes to what customer proprietary information
line 11 the provider collects, and how it uses, discloses, or permits access
line 12 to that information, the categories of entities to which it discloses
line 13 or permits access to customer proprietary information, and which,
line 14 if any, changes are retroactive.
line 15 (B)  A customer’s opt-in approval or opt-out approval rights
line 16 with respect to his or her customer proprietary information,
line 17 including the material specified in paragraph (4) of subdivision
line 18 (a).
line 19 (3)  It shall provide for access to a mechanism for a customer
line 20 to grant, deny, or withdraw approval for the provider to use,
line 21 disclose, or permit access to his or her customer proprietary
line 22 information as required by Section 22553.
line 23 (4)  It shall be completely translated into a language other than
line 24 English if the provider transacts business with the customer in
line 25 that language.
line 26 22553. (a)  (1)  Except as described in paragraph (2), a
line 27 communications provider shall not use, disclose, or permit access
line 28 to customer proprietary information except with the opt-out or
line 29 opt-in approval of a customer as described in this section.
line 30 (2)  A provider may use, disclose, or permit access to customer
line 31 proprietary information without customer approval for any of the
line 32 following purposes:
line 33 (A)  In its provision of the communications service from which
line 34 the information is derived, or in its provision of services necessary
line 35 to, or used in, the provision of the service.
line 36 (B)  To initiate, render, bill, and collect for communications
line 37 service.
line 38 (C)  To protect the rights or property of the provider, or to
line 39 protect users of the communications service and other providers
line 40 from fraudulent, abusive, or unlawful use of the service.

96
 — 13 — AB 375

line1 (D)  To provide any inbound marketing, referral, or

line 2 administrative services to the customer for the duration of a
line 3 real-time interaction, if the interaction was initiated by the
line 4 customer.
line 5 (E)  To provide location information or nonsensitive customer
line 6 proprietary information to any of the following:
line 7 (i)  A public safety answering point, emergency medical service
line 8 provider or emergency dispatch provider, public safety, fire
line 9 service, or law enforcement official, or hospital emergency or
line 10 trauma care facility, in order to respond to the user’s request for
line 11 emergency services.
line 12 (ii)  The user’s legal guardian or members of the user’s
line 13 immediate family of the user’s location in an emergency situation
line 14 that involves the risk of death or serious physical harm.
line 15 (iii)  Providers of information or database management services
line 16 solely for purposes of assisting in the delivery of emergency
line 17 services in response to an emergency.
line 18 (F)  As otherwise required or authorized by law.
line 19 (b)  Except as otherwise provided in this section, a
line 20 communications provider shall obtain opt-out approval from a
line 21 customer to use, disclose, or permit access to any of the customer’s
line 22 nonsensitive customer proprietary information. If it so chooses, a
line 23 provider may instead obtain opt-in approval from a customer to
line 24 use, disclose, or permit access to any of the customer’s nonsensitive
line 25 customer proprietary information.
line 26 (c)  Except as otherwise provided in this section, a
line 27 communications provider shall obtain opt-in approval from a
line 28 customer to do either of the following:
line 29 (1)  Use, disclose, or permit access to any of the customer’s
line 30 sensitive customer proprietary information.
line 31 (2)  Make any material retroactive change, including a material
line 32 change that would result in a use, disclosure, or permission of
line 33 access to any of the customer’s proprietary information previously
line 34 collected by the provider for which the customer did not previously
line 35 grant approval, either through opt-in or opt-out consent, as
line 36 required by subdivision (b) and this subdivision.
line 37 (d)  (1)  Except as described in subdivision (a), a communications
line 38 provider shall, at a minimum, solicit customer approval pursuant
line 39 to subdivision (b) or (c), as applicable, at the point of sale and
line 40 when making one or more material changes to privacy policies.

96
 AB 375 — 14 —

line 1 The solicitation may be part of, or the same communication as, a
line 2 notice required by Section 22552.
line 3 (2)  A provider’s solicitation of customer approval shall be clear
line 4 and conspicuous, and in language that is comprehensible and not
line 5 misleading. The solicitation shall disclose all of the following:
line 6 (A)  The types of customer proprietary information that the
line 7 provider is seeking customer approval to use, disclose, or permit
line 8 access to.
line 9 (B)  The purposes for which the customer proprietary information
line 10 will be used.
line 11 (C)  The categories of entities to which the provider intends to
line 12 disclose or permit access to the customer proprietary information.
line 13 (D)  A means to easily access the notice required by subdivision
line 14 (a) of Section 22552 and a means to access the mechanism required
line 15 by subdivision (e).
line 16 (3)  A provider’s solicitation of customer approval shall be
line 17 completely translated into a language other than English if the
line 18 provider transacts business with the customer in that language.
line 19 (e)  A communications provider shall make available a simple,
line 20 easy-to-use mechanism for customers to grant, deny, or withdraw
line 21 opt-in approval and opt-out approval at any time. The mechanism
line 22 shall be clear and conspicuous, in language that is comprehensible
line 23 and not misleading, and made available at no additional cost to
line 24 the customer. The mechanism shall be persistently available on
line 25 or through the provider’s Internet Web site, the provider’s
line 26 application if it provides one for account management purposes,
line 27 and any functional equivalent to the provider’s homepage or
line 28 application. If the provider does not have an Internet Web site, it
line 29 shall provide a persistently available mechanism by another means
line 30 such as a toll-free telephone number. The customer’s grant, denial,
line 31 or withdrawal of approval shall be given effect promptly and
line 32 remain in effect until the customer revokes or limits the grant,
line 33 denial, or withdrawal of approval.
line 34 22554. (a)  In addition to the requirements of Section 1798.81.5
line 35 of the Civil Code, a communications provider shall take reasonable
line 36 measures to protect customer proprietary information from
line 37 unauthorized use, disclosure, or access.
line 38 (b)  The security measures taken by a communications provider
line 39 to implement the requirement set forth in this section shall, as
line 40 appropriate, take into account each of the following factors:

96
 — 15 — AB 375

line 1 (1)  The nature and scope of the provider’s activities.

line 2 (2)  The sensitivity of the data it collects.
line 3 (3)  The size of the provider.
line 4 (4)  Technical feasibility.
line 5 (c)  A communications provider may employ a lawful security
line 6 measure that allows it to implement the requirement set forth in
line 7 this section.
line 8 22555. (a)  (1)  In addition to the requirements of Section
line 9 1798.82 of the Civil Code, a communications provider shall notify
line 10 an affected customer of any breach without unreasonable delay
line 11 and in any event no later than 30 calendar days after the provider
line 12 reasonably determines that a breach has occurred, subject to law
line 13 enforcement needs, unless the provider can reasonably determine
line 14 that no harm to the customer is reasonably likely to occur as a
line 15 result of the breach.
line 16 (2)  A provider required to provide notification to a customer
line 17 under this subdivision shall provide the notice by one or both of
line 18 the following methods:
line 19 (A)  Written notification sent to either the customer’s email
line 20 address or the postal address on record of the customer, or, for
line 21 former customers, to the last postal address ascertainable after
line 22 reasonable investigation using commonly available sources.
line 23 (B)  Other electronic means of active communications agreed
line 24 upon by the customer for contacting that customer for data breach
line 25 notification purposes.
line 26 (3)  The customer notification required to be provided under
line 27 this subdivision shall include all of the following:
line 28 (A)  The date, estimated date, or estimated date range of the
line 29 breach of security.
line 30 (B)  A description of the customer proprietary information that
line 31 was breached or reasonably believed to have been breached.
line 32 (C)  Information the customer can use to contact the provider
line 33 to inquire about the breach of security and the customer
line 34 proprietary information that the provider maintains about that
line 35 customer.
line36 (D)  Information about how to contact the Federal
line 37 Communications Commission.
line 38 (E)  If the breach creates a risk of financial harm, information
line 39 about the national credit-reporting agencies and the steps the
line 40 customer can take to guard against identity theft, including any

96
 AB 375 — 16 —

line 1 credit monitoring, credit reporting, credit freezes, or other

line 2 consumer protections the provider is offering customers affected
line 3 by the breach of security.
line 4 (b)  A communications provider shall notify the Federal
line 5 Communications Commission of any breach affecting 5,000 or
line 6 more customers no later than seven business days after the provider
line 7 reasonably determines that a breach has occurred and at least
line 8 three business days before notification to the affected customers,
line 9 unless the provider can reasonably determine that no harm to
line 10 customers is reasonably likely to occur as a result of the breach.
line 11 A provider shall notify the Federal Communications Commission
line 12 of any breach affecting fewer than 5,000 customers without
line 13 unreasonable delay and no later than 30 calendar days after the
line 14 provider reasonably determines that a breach has occurred, unless
line 15 the provider can reasonably determine that no harm to customers
line 16 is reasonably likely to occur as a result of the breach.
line 17 (c)  A communications provider shall notify the Federal Bureau
line 18 of Investigation and the United States Secret Service of a breach
line 19 that affects 5,000 or more customers no later than seven business
line 20 days after the provider reasonably determines that a breach has
line 21 occurred and at least three business days before notification to
line 22 the affected customers, unless the provider can reasonably
line 23 determine that no harm to customers is reasonably likely to occur
line 24 as a result of the breach.
line 25 (d)  A communications provider shall maintain a record,
line 26 electronically or in some other manner, of any breaches and
line 27 notifications made to customers, unless the provider can
line 28 reasonably determine that no harm to customers is reasonably
line 29 likely to occur as a result of the breach. The record shall include
line 30 the dates on which the provider determines that a reportable
line 31 breach has occurred and the dates of customer notification. The
line 32 record shall include a written copy of all customer notifications.
line 33 A provider shall retain the record for a minimum of two years from
line 34 the date on which it determines that a reportable breach has
line 35 occurred.
line36 22556. A communications provider may bind itself
line 37 contractually to privacy and data security regimes other than those
line 38 described in this chapter for the provision of communications
line 39 services other than broadband Internet access service to enterprise
line 40 customers if the provider’s contract with that customer specifically

96
 — 17 — AB 375

line 1 addresses the issues of transparency, choice, data security, and

line 2 data breach and provides a mechanism for the customer to
line 3 communicate with the provider about privacy and data security
line 4 concerns.
line 5 22557. A broadband Internet access service provider shall not
line 6 do either of the following:
line 7 (a)  Refuse to provide broadband Internet access service, or in
line 8 any way limit that service, to a customer who does not waive his
line 9 or her privacy rights guaranteed by law or regulation, including
line 10 this chapter.
line 11 (b)  Charge a customer a penalty, penalize a customer in any
line 12 way, or offer a customer a discount or another benefit, as a direct
line 13 or indirect consequence of a customer’s decision to, or refusal to,
line 14 waive his or her privacy rights guaranteed by law or regulation,
line 15 including this chapter.
line 16 22558. This chapter shall not limit the other statutory rights
line 17 of a customer or the statutory obligations of a communications
line 18 provider, including, but not limited to, the rights and obligations
line 19 described in this division, Section 1798.82 of the Civil Code, and
line 20 Article 3 (commencing with Section 2891) of Chapter 10 of Part
line 21 2 of Division 1 of the Public Utilities Code.
line 22 22949.7.
line 23 22559. The requirements of this chapter shall apply to
line 24 broadband Internet access service providers operating within
line 25 California when providing broadband Internet access service to
line 26 their customers who are residents of and physically located in
line 27 California. Any Except as described in Section 22556, any waiver
line 28 by the customer of the provisions of this chapter shall be deemed
line 29 contrary to public policy and shall be void and unenforceable.
line 30 22949.8. The provisions of this act are severable. If any
line 31 provision of this act or its application is held invalid, that invalidity
line 32 shall not affect other provisions or applications that can be given
line 33 effect without the invalid provision or application.
line 34 It is the intent of the Legislature that this chapter would have
line 35 been adopted regardless of whether an invalid provision had not
line 36 been included or an invalid application had not been made
line 37 22949.9.
line 38 22560. California adopts this chapter pursuant to all inherent
line 39 state authority under the Tenth Amendment of the United States
line 40 Constitution and all relevant authority granted and reserved to the

96
 AB 375 — 18 —

line 1 states by Title 47 of the United States Code, including the authority
line 2 to impose requirements necessary to protect public safety and
line 3 welfare, safeguard the rights of consumers, manage public
line 4 rights-of-way, and regulate franchises. California further adopts
line 5 this law pursuant to the inalienable right of privacy granted under
line 6 the authority of Article I, Section 1 of the California Constitution.
line 7 SEC. 2. The provisions of this act are severable. If any
line 8 provision of this act or its application is held invalid, that invalidity
line 9 shall not affect other provisions or applications that can be given
line 10 effect without the invalid provision or application.

96