Assembly BillChaptered/SignedCivil
AB 45: Privacy: health data: location and research.
What AB 45 does, verified December 8, 2025
This bill would prohibit the collection, use, disclosure, sale, sharing, or retention of personal information of individuals located near family planning centers, with certain exceptions. It would also prevent geofencing or selling/sharing personal information with third parties to geofence entities providing in-person healthcare services for specified purposes. Violators would be subject to an injunction and liable for a civil penalty, which would be used to fund reproductive health education programs. The bill would also expand the crime of perjury and require the state to reimburse local agencies and school districts for certain costs not mandated by the bill. Additionally, it would restrict the release of research records in a personally identifiable form in response to certain subpoenas or requests.
Bill journey
✓IntroducedComplete
✓In CommitteeComplete
✓First Chamber FloorComplete
✓Second ChamberComplete
✓GovernorComplete
6ChapteredCurrent
Last action: Chaptered by Secretary of State - Chapter 134, Statutes of 2025. (2025-09-13)Alert me
Author and sponsors
Full contact details, staff, and committees with Connect, $16/moUnlockRecent actions37 total · showing 5
| Sep. 26, 2025 | Chaptered by Secretary of State - Chapter 134, Statutes of 2025. |
| Sep. 26, 2025 | Approved by the Governor. |
| Sep. 24, 2025 | Enrolled and presented to the Governor at 3 p.m. |
| Sep. 13, 2025 | Senate amendments concurred in. To Engrossing and Enrolling. (Ayes 61. Noes 12. Page 3469.). |
| Sep. 13, 2025 | Joint Rules 61(a)(14) and 51(a)(4) suspended. (Ayes 59. Noes 20. Page 3413.) |
Latest bill textChaptered version, September 26, 2025 · 3,733 words
Assembly Bill No. 45
CHAPTER 134
An act to amend Section 1798.99.90 of, to amend the heading of Title 1.81.49 (commencing with Section 1798.99.90) of Part 4 of Division 3 of, and to add Sections 1798.99.91, 1798.99.92, and 1798.99.93 to, the Civil Code, and to amend Section 140 of the Health and Safety Code, relating to privacy.
[ Approved by Governor September 26, 2025. Filed with Secretary of State September 26, 2025. ]
LEGISLATIVE COUNSEL'S DIGEST
AB 45, Bauer-Kahan. Privacy: health data: location and research.
Existing law prohibits a person or business, as defined, from collecting, using, disclosing, or retaining the personal information of a person who is physically located at, or within a precise geolocation of, a family planning center, as defined, except as necessary to perform the services or provide the goods requested and prohibits a person or business from selling or sharing this personal information. Existing law authorizes an aggrieved person or entity to institute and prosecute a civil action against a person or business for a violation of these provisions and specifies the damages and costs authorized to be recovered.
This bill would recast the above-described provisions, and instead prohibit the collection, use, disclosure, sale, sharing, or retention of the personal information of a natural person who is physically located at, or within a precise geolocation of, a family planning center, except under certain circumstances, including, among others, for the collection or use as necessary to perform the services or provide the goods requested. The bill would also provide that these provisions do not alter applicable law regarding use by a law enforcement agency, as defined, of personal information generated by an electronic monitoring device. The bill would authorize an aggrieved person to institute and prosecute a civil action against a natural person, association, proprietorship, corporation, trust, foundation, partnership, or any other organization or group of people acting in concert for a violation of these provisions. The bill would also make other nonsubstantive changes.
This bill would, subject to specified exceptions, prohibit geofencing, or selling or sharing personal information with a third party to geofence, as defined, an entity that provides in-person health care services in California for specified purposes, and would prohibit the use of personal information obtained in violation of this provision. The bill would provide that violators are subject to an injunction and liable for a civil penalty assessed and recovered in a civil action brought by the Attorney General, and deposited in the California Reproductive Justice and Freedom Fund. The bill would require those penalties to be awarded by the State Department of Public Health for grants to implement a program or to fund an existing program that provides and promotes medically accurate and comprehensive reproductive and sexual health education, as provided. The bill would also provide that a statement signed under penalty of perjury, as specified, that the personal information will not be used for selling or sharing personal information in violation of these geofencing provisions is prima facie evidence that the personal information was not sold or shared in violation of these geofencing provisions. By expanding the crime of perjury, this bill would impose a state-mandated local program.
Existing law, the Confidentiality of Medical Information Act (CMIA), generally prohibits a provider of health care, a health care service plan, or a contractor from disclosing medical information regarding a patient, enrollee, or subscriber without first obtaining an authorization, unless a specified exception applies. The CMIA prohibits a provider of health care, a health care service plan, a contractor, or an employer from releasing medical information that would identify an individual or related to an individual seeking or obtaining an abortion in response to a subpoena or a request or to law enforcement if that subpoena, request, or the purpose of law enforcement for the medical information is based on, or for the purpose of enforcement of, either another state’s laws that interfere with a person’s rights to choose or obtain an abortion or a foreign penal civil action.
This bill would, similar to the provisions of the CMIA, prohibit the release of research records, in a personally identifying form, developed or acquired by a person in the course of conducting research relating to anyone seeking or obtaining health care services, or relating to personal information, in response to a subpoena or a request or to law enforcement if that subpoena, request, or the purpose of law enforcement for the medical information is based on, or for the purpose of enforcement of, either another state’s laws that interfere with a person’s rights to choose or obtain an abortion or a foreign penal civil action.
The California Constitution requires the state to reimburse local agencies and school districts for certain costs mandated by the state. Statutory provisions establish procedures for making that reimbursement.
This bill would provide that no reimbursement is required by this act for a specified reason.
The people of the State of California do enact as follows:
SECTION 1.
The heading of Title 1.81.49 (commencing with Section 1798.99.90) of Part 4 of Division 3 of the Civil Code is amended to read:TITLE 1.81.49. Health and Location Data Privacy
SEC. 2.
Section 1798.99.90 of the Civil Code is amended to read:1798.99.90.
For purposes of this title, the following definitions apply:(a) “Collect,” “collected,” or “collection” means buying, renting, gathering, obtaining, receiving, or accessing any personal information pertaining to a natural person by any means. This includes receiving information from the natural person, either actively or passively, or by observing the natural person’s behavior.
(b) “Family planning center” means a facility categorized as a family planning center by the North American Industry Classification System adopted by the United States Census Bureau, including, but not limited to, a clinic or center that provides reproductive health care services as defined in Section 1798.300.
(c) “Geofence” means any technology that enables spatial or location detection to establish a virtual boundary around, and detect an individual’s presence within, a “precise geolocation” as defined in subdivision (w) of Section 1798.140.
(d) “Health care services” means any service provided to a natural person of a medical, surgical, psychiatric, therapeutic, diagnostic, mental health, behavioral health, preventative, rehabilitative, supportive, consultative, referral, or prescribing nature.
(e) “Person” means a natural person, association, proprietorship, corporation, trust, foundation, partnership, or any other organization or group of people acting in concert.
(f) “Personal information” has the same definition as that term is defined in subdivision (v) of Section 1798.140, except as applied to all natural persons and not limited to consumers and households, as those terms are defined in subdivisions (i) and (q), respectively, of that section.
(g) “Precise geolocation” means a geographic area that is equal to or less than the area of a circle with a radius of 1,850 feet as derived from a device that is used or intended to be used to locate a person. If the geographic scope of the term “precise geolocation” as defined in Section 1798.140 is expanded beyond 1,850 feet, then that larger scope shall apply to this definition of precise geolocation.
(h) “Research” means systematic investigation, including research development, testing, and evaluation, that has as its primary purpose the development of, or contribution to, generalizable knowledge.
(i) “Sell,” “selling,” “sale,” or “sold” means selling, renting, releasing, disclosing, disseminating, making available, transferring, or otherwise communicating orally, in writing, or by electronic or other means, a natural person’s personal information by another person to a third party for monetary or other valuable consideration.
(j) “Share,” “shared,” or “sharing” means sharing, renting, releasing, disclosing, disseminating, making available, transferring, or otherwise communicating orally, in writing, or by electronic or other means, a natural person’s personal information by another person to a third party, whether or not for monetary or other valuable consideration.
SEC. 3.
Section 1798.99.91 is added to the Civil Code, immediately following Section 1798.99.90, to read:1798.99.91.
(a) It shall be unlawful to collect, use, disclose, sell, share, or retain the personal information of a natural person who is physically located at, or within a precise geolocation of, a family planning center, except as specified in subdivision (b) or as otherwise provided by law or in a collective bargaining agreement.(b) Notwithstanding subdivision (a), it is permissible to collect or use the personal information of a natural person who is physically located at, or within a precise geolocation of, a family planning center, but only as necessary to perform the services or provide the goods requested by the natural person. All other prohibitions under subdivision (a) shall continue to apply.
(c) (1) An aggrieved person or entity, including a family planning center, may institute and prosecute a civil action against any person who violates this section for injunctive and monetary relief and attorney’s fees within three years of discovery of the violation.
(2) If the court finds for the petitioner in an action authorized by paragraph (1), recovery shall be in the amount of three times the amount of actual damages and any other expenses, costs, or reasonable attorney’s fees incurred in connection with the litigation.
(d) (1) This section does not apply to a provider of health care, a health care service plan, or contractor, as those terms are defined in Section 56.05 or to a covered entity or its business associate, as defined in Section 160.103 of Title 45 of the Code of Federal Regulations.
(2) In order to qualify for this exemption, a contractor or business associate must be contractually obligated to comply with all applicable state and federal privacy laws.
(e) (1) Nothing in this section shall be construed to alter applicable law, including pursuant to Section 3010 of the Penal Code, regarding use by a law enforcement agency of personal information, including geolocation information, generated by an electronic monitoring device.
(2) For purposes of this section, “law enforcement agency” means any department or agency of the state or any local government, special district, or other political subdivision thereof that employs any peace officer, as described in Chapter 4.5 (commencing with Section 830) of Title 3 of Part 2 of the Penal Code.
SEC. 4.
Section 1798.99.92 is added to the Civil Code, immediately following Section 1798.99.91, to read:1798.99.92.
(a) Except as provided in subdivision (f), it shall be unlawful to geofence an entity that provides in-person health care services in California for any of the following purposes:(1) To identify or track a person seeking, receiving, or providing health care services.
(2) To collect personal information from a person seeking, receiving, or providing health care services.
(3) To send notifications to a person related to their personal information or health care services.
(4) To send advertisements to a person related to the person’s personal information or health care services.
(b) It shall be unlawful to sell personal information to, or share personal information with, a third party for the use of such information to violate subdivision (a). A statement signed under penalty of perjury, pursuant to Section 2015.5 of the Code of Civil Procedure, by a natural person authorized to enter into agreements on behalf of the third party that the personal information will not be used for these purposes shall be prima facie evidence that the personal information was not sold or shared in violation of this subdivision.
(c) Except as provided in subdivision (f), it shall be unlawful to use personal information obtained in violation of subdivision (a) or (b).
(d) (1) Any person that violates this section shall be subject to an injunction and liable for a civil penalty of twenty-five thousand dollars ($25,000) for each violation, which shall be assessed and recovered in a civil action brought in the name of the people of the State of California by the Attorney General. The court may consider the good faith cooperation of the entity or person in determining the amount of the civil penalty.
(2) Any civil penalty recovered by an action brought by the Attorney General for a violation of this section, and the proceeds of any settlement of any said action, shall be deposited in the California Reproductive Justice and Freedom Fund established pursuant to Section 140 of the Health and Safety Code.
(e) This section shall be implemented consistent with state and federal law.
(f) (1) (A) This section does not prohibit any person that owns, operates, manages, or otherwise provides services to an in-person health care entity from geofencing the entity’s own location to provide necessary health care services, including the use of location-based alarm devices to monitor newborns and memory-impaired individuals.
(B) This section does not prohibit any person that provides reproductive health care services, as defined in Section 1798.300, from utilizing geofencing for the purpose of providing security services to protect patients, staff, or property.
(2) Nothing in this section shall exempt any person from complying with any of the following:
(A) A lawfully executed search warrant.
(B) A lawful subpoena issued pursuant to existing California law.
(C) Law enforcement if law enforcement, in good faith, believes that an emergency involving danger of death or serious physical injury to any person requires access to such geofencing data. For purposes of this subparagraph, accessing, procuring, or searching for services regarding contraception, pregnancy care, and perinatal care, including, but not limited to, abortion services, shall not constitute being at risk or danger of death or serious physical injury.
(3) Nothing in this section abrogates or limits the requirements of the Electronic Communications Privacy Act (Chapter 3.6 (commencing with Section 1546) of Title 12 of Part 2 of the Penal Code).
(4) Nothing in this section shall apply to geofencing activities conducted solely for research purposes by an investigator within an institution that holds an assurance with the federal Department of Health and Human Services pursuant to Part 46 (commencing with Section 46.101) of Title 45 of the Code of Federal Regulations and who obtains informed consent in the method and manner required by those regulations.
(5) (A) This section does not prohibit geofencing activities conducted by a labor organization, as defined in Section 1117 of the Labor Code, or an employee organization, as defined in subdivision (a) of Section 3501 of, subdivision (a) of Section 3513 of, or subdivision (f) of Section 3562 of, the Government Code, if geofencing does not result in the labor union’s collection of names or personal information without the express consent of an individual and is for activities concerning workplace conditions, worker or patient safety, labor disputes, or organizing.
(B) A third party vendor, including, but not limited to, a social media platform, that collects personal information from a labor organization or employee organization pursuant to subparagraph (A) shall be prohibited from selling, using, or sharing that personal information for any purpose other than the activities described in subparagraph (A).
SEC. 5.
Section 1798.99.93 is added to the Civil Code, immediately following Section 1798.99.92, to read:1798.99.93.
(a) Research records, in a personally identifying form, developed or acquired by a person in the course of conducting research relating to anyone seeking or obtaining health care services, or relating to personal information, shall be subject to the restrictions on release set forth in this section.(b) Research records, in a personally identifying form, developed or acquired by a person in the course of conducting research relating to anyone seeking or obtaining health care services, or relating to personal information, shall not be released in response to a subpoena or request if that subpoena or request is based on either another state’s laws that interfere with a person’s rights under the Reproductive Privacy Act (Article 2.5 (commencing with Section 123460) of Chapter 2 of Part 2 of Division 106 of the Health and Safety Code) or a foreign penal civil action, as defined in Section 2029.200 of the Code of Civil Procedure.
(c) Research records, in a personally identifying form, developed or acquired by a person in the course of conducting research relating to anyone seeking or obtaining health care services, or relating to personal information, shall not be released to law enforcement for either of the following purposes, unless that release is pursuant to a subpoena not otherwise prohibited by subdivision (b):
(1) Enforcement of another state’s law that interferes with a person’s rights under the Reproductive Privacy Act (Article 2.5 (commencing with Section 123460) of Chapter 2 of Part 2 of Division 106 of the Health and Safety Code).
(2) Enforcement of a foreign penal civil action, as defined in Section 2029.200 of the Code of Civil Procedure.
SEC. 6.
Section 140 of the Health and Safety Code is amended to read:140.
(a) The California Reproductive Justice and Freedom Fund (RJ Fund) is hereby established. The goal of the RJ Fund is to dismantle historic and standing systemic reproductive and sexual health inequities through medically accurate, culturally congruent education and outreach, as well as to create innovative strategies that meaningfully address and function to eliminate root causes of reproductive oppression.(b) Upon appropriation by the Legislature, the State Department of Public Health shall award grants from the RJ Fund to eligible community-based organizations over a three-year period.
(1) On or before July 1, 2023, the department shall post the grant application on its internet website and solicit applications.
(2) On or before December 31, 2023, the department shall award grants to selected entities based on the eligibility criteria.
(c) Notwithstanding paragraphs (1) and (2) of subdivision (b), any civil penalties deposited in the RJ Fund pursuant to Section 1798.99.92 of the Civil Code shall be awarded by the State Department of Public Health in the form of grants, subject to the criteria specified in subdivisions (d) to (h), inclusive.
(d) A grant recipient shall use any grant funds awarded pursuant to this section to implement a program or fund an existing program that provides and promotes medically accurate, comprehensive reproductive and sexual health education.
(e) A program funded pursuant to this section shall do all of the following:
(1) Promote reproductive justice.
(2) Provide medically accurate, culturally congruent reproductive and sexual health education that is inclusive of information on abortion rights, care, and services. The education or outreach provided by a program shall include information on how to obtain an abortion or provide abortion referrals, especially upon request.
(3) Be targeted at communities that have experienced or continue to experience high reproductive or sexual health inequities or disparities. This includes communities that have experienced reproductive or sexual health inequities or disparities because of historic and systemic oppression, including based on their race and ethnicity, immigration status, sexual orientation, gender expression, foster youth status, or disability.
(f) A grant recipient may use a portion of grant funds to pay for costs associated with carrying out grant activities. An assessment of associated costs shall contemplate the community-based organization, the community served, and the nature of services it provides, and may include all of the following:
(1) Building staff capacity.
(2) Development and dissemination of materials.
(3) Travel costs.
(g) The department shall not spend more than 5 percent of the funds appropriated for the purposes of this section on administrative costs.
(h) For purposes of this section:
(1) “Community-based organization” means a public or private not-for-profit organization that provides education, resources, or services and is representative of a disparately impacted community or significant segments of a community or has demonstrated status as a trusted part of the community that it serves.
(2) “Culturally congruent education” means education that takes account of the cultural beliefs, values, norms, patterns, way of life, or practices of the target audience to provide appropriate and meaningful education. Culturally congruent education and outreach fits a person’s or community’s lifestyle, values, and systems of meaning. It requires acknowledgment, respect, and adaptation of information to the cultural needs of the communities served. Additionally, it contemplates sociocultural and situational factors into education.
(3) “Medically accurate” means factual information, verified or supported by research conducted in compliance with scientific methods, published in peer-reviewed journals, if appropriate, and recognized as accurate and objective by the relevant professional organizations.
(4) “Racial equity” means the condition achieved when race can no longer be used to predict life outcomes and when conditions for all groups are improved. Racial equity includes transforming the behaviors, institutions, and systems that harm disparately impacted communities, including by increasing access to power, redistributing and providing additional resources, and eliminating barriers to opportunity, in order to empower Black, Indigenous, and communities of color to thrive and realize their full potential.
(5) “Reproductive health” means the state of complete physical, mental, and social well-being, and not merely the absence of disease or infirmity, in all matters relating to the reproductive system and to its functions and processes. “Reproductive health” implies that a person is able to have a satisfying and safe sex life and that they have the capability to reproduce and the freedom to decide if, when, and how often to do so.
(6) “Reproductive justice” means the human right to control our sexuality, our gender, our work, and our reproduction, which can only be achieved when all people, particularly women and girls, have the complete economic, social, and political power and resources to make healthy decisions about their bodies, their families, and their communities in all areas of their lives. At the core of “reproductive justice” is the belief that all people have the right to have children, the right to not have children, and the right to parent the children they have with dignity and respect, in safe and sustainable communities.
(7) “Sexual health” means the state of physical, emotional, mental, and social well-being in relation to sexuality, and not merely the absence of disease, dysfunction, or infirmity. “Sexual health” requires a positive and respectful approach to sexuality and sexual relationships, as well as the possibility of having pleasurable and safe sexual experiences, free of coercion, discrimination, and violence.
SEC. 7.
No reimbursement is required by this act pursuant to Section 6 of Article XIII B of the California Constitution because the only costs that may be incurred by a local agency or school district will be incurred because this act creates a new crime or infraction, eliminates a crime or infraction, or changes the penalty for a crime or infraction, within the meaning of Section 17556 of the Government Code, or changes the definition of a crime within the meaning of Section 6 of Article XIII B of the California Constitution.Text of AB 45 as chaptered, from the official record. Connect Plus keeps every version and highlights what changed.Compare versions