Chapter 3.25 - Online Privacy for Reproductive Health Services Providers, Employees, Volunteers, and Patients

Sections (3)

Amended by Stats. 2025, Ch. 679, Sec. 4. (AB 82) Effective January 1, 2026.

(a)(1) A person, business, or association shall not knowingly publicly post or publicly display, disclose, or distribute on internet websites or social media, the personal information or image of any designated health care services provider, employee, volunteer, or patient, or other individuals residing at the same home address, with the intent to do either of the following:

(A) Incite a third person to cause imminent great bodily harm to the designated health care services provider, employee, volunteer, or patient identified in the posting or display, or to a coresident of that person, where the third person is likely to commit this harm.

(B) Threaten the designated health care services provider, employee, volunteer, or patient, identified in the posting or display, or a coresident of that person, in a manner that places the person identified or the coresident in objectively reasonable fear for their personal safety.

(2)A designated health care services provider, employee, volunteer, or patient whose personal information or image is made public as a result of a violation of paragraph (1), or any individual entity or organization authorized to act on their behalf, may do either or both of the following:

(A)Bring an action seeking injunctive or declarative relief in any court of competent jurisdiction. If a jury or court finds that a violation has

occurred, it may grant injunctive or declarative relief and shall award the successful plaintiff court costs and reasonable attorney’s fees.

(B)Bring an action for money damages in any court of competent jurisdiction. In addition to any other legal rights or remedies, if a jury or court finds that a violation has occurred, it shall award damages to that individual in an amount up to a maximum of three times the actual damages, but in no case less than four thousand dollars ($4,000).

(b)(1) A person, business, or association shall not publicly post or publicly display, disclose, or distribute, on internet websites or social media, the personal information or image of a designated health care services provider, employee, volunteer, or patient if that

individual, or any individual, entity, or organization authorized to act on their behalf, has made a written demand of that person, business, or association to not disclose the personal information or image. A written demand made under this paragraph shall include a statement declaring that the individual is subject to the protection of this section and describing a reasonable fear for the safety of that individual or of any person residing at the individual’s home address, based on a violation of subdivision (a). A demand made under this paragraph shall be effective for four years, regardless of whether or not the individual’s affiliation with a designated health care services facility has expired prior to the end of the four-year period.

(2)A designated health care services provider, employee, volunteer, or patient whose personal information

or image is made public as a result of a failure to honor a demand made pursuant to paragraph (1), or any individual, entity, or organization authorized to act on their behalf, may bring an action seeking injunctive or declarative relief in any court of competent jurisdiction. If a jury or court finds that a violation has occurred, it may grant injunctive or declarative relief and shall award the successful plaintiff court costs and reasonable attorney’s fees.

(3)This subdivision does not apply to a person or entity defined in Section 1070 of the Evidence Code.

(c)(1) A person, business, or association shall not solicit, sell, or trade on the internet or social media the personal information or image of a designated health care services provider, employee,

volunteer, or patient with the intent to do either of the following:

(A) Incite a third person to cause imminent great bodily harm to the person identified in the posting or display, or to a coresident of that person, where the third person is likely to commit this harm.

(B) Threaten the person identified in the posting or display, or a coresident of that person, in a manner that places the person identified or the coresident in objectively reasonable fear for their personal safety.

(2)A designated health care services provider, employee, volunteer, or patient whose personal information or image is solicited, sold, or traded in violation of paragraph (1), or any individual, entity, or organization authorized to act on

their behalf, may bring an action in any court of competent jurisdiction. In addition to any other legal rights and remedies, if a jury or court finds that a violation has occurred, it shall award damages to that individual in an amount up to a maximum of three times the actual damages, but in no case less than four thousand dollars ($4,000).

(d)An interactive computer service or access software provider, as defined in Section 230(f) of Title 47 of the United States Code, shall not be liable under this section unless the service or provider intends to abet or cause bodily harm that is likely to occur or threatens to cause bodily harm to a designated health care services patient, provider, or assistant, or any person residing at the same home address.

(e)This section does not

preclude punishment under any other provision of law.

§ 6218.01

Amended by Stats. 2025, Ch. 679, Sec. 5. (AB 82) Effective January 1, 2026.

(a)(1) A person shall not post on the internet or social media, with the intent that another person imminently use that information to commit a crime involving violence or a threat of violence against a designated health care services provider, employee, volunteer, or patient, or other individuals residing at the same home address, the personal information or image of a designated health care services patient, provider, or assistant, or other individuals residing at the same home address.

(2)A violation of this subdivision is punishable by a fine of up to ten thousand dollars ($10,000) per violation, imprisonment of either up to one year in a county jail

or pursuant to subdivision (h) of Section 1170 of the Penal Code, or by both that fine and imprisonment.

(3)A violation of this subdivision that leads to the bodily injury of a designated health care services provider, employee, volunteer, or patient, or other individuals residing at the same home address, is a felony punishable by a fine of up to fifty thousand dollars ($50,000), imprisonment pursuant to subdivision (h) of Section 1170 of the Penal Code, or by both that fine and imprisonment.

(b)Nothing in this section shall preclude prosecution under any other provision of law.

§ 6218.05

Amended by Stats. 2025, Ch. 679, Sec. 6. (AB 82) Effective January 1, 2026.

For purposes of this chapter, the following definitions apply:

(a)“Designated health care services” means gender-affirming health care services or reproductive health care services.

(b)“Designated health care services provider, employee, volunteer, or patient” means a gender-affirming health care or a gender-affirming mental health care provider, employee, volunteer, or patient, or a reproductive health care services provider, employee, volunteer, or patient.

(c)“Designated health care services facility” means a gender-affirming health care

services facility or a reproductive health care services facility.

(d)“Gender-affirming health care” and “gender-affirming mental health care” shall have the same meaning as provided in Section 16010.2 of the Welfare and Institutions Code.

(e)“Gender-affirming health care and gender-affirming mental health care provider, employee, volunteer, or patient” means a person who obtains, provides, or assists, at the request of another person, in obtaining or providing gender-affirming health care services, or a person who owns or operates a gender-affirming health care services facility.

(f)“Gender-affirming health care services facility” includes a hospital, an office operated by a licensed physician and surgeon, a

licensed clinic, or other licensed health care facility that provides gender-affirming health care services and includes only the building or structure in which the gender-affirming health care services are actually provided.

(g)“Image” includes, but is not limited to, a photograph, video footage, sketch, or computer-generated image that provides a means to visually identify the person depicted.

(h)“Personal information” means information that identifies, relates to, describes, or is capable of being associated with a reproductive health care services patient, provider, or assistant, including, but not limited to, their name, signature, social security number, physical characteristics or description, address, telephone number, passport number, driver’s license or state

identification card number, license plate number, employment, employment history, and financial information.

(i)“Publicly post” or “publicly display” means to intentionally communicate or otherwise make available to the general public.

(j)“Reproductive health care services” means health care services relating to the termination of a pregnancy in a reproductive health care services facility.

(k)“Reproductive health care services patient, provider, or assistant” means a person or entity, including, but not limited to, employees, staff, volunteers, and third-party vendors, that is or was involved in obtaining, seeking to obtain, providing, seeking to provide, or assisting or seeking to assist another person, at that

person’s request, to obtain or provide any services in a reproductive health care services facility, or a person or entity that is or was involved in owning or operating or seeking to own or operate a reproductive health care services facility.

(l)“Reproductive health care services facility” includes a hospital, clinic, physician’s office, or other facility that provides or seeks to provide reproductive health care services and includes the building or structure in which the facility is located.

(m)“Social media” means an electronic service or account, or electronic content, including, but not limited to, videos or still photographs, blogs, video blogs, podcasts, instant and text messages, email, online services or accounts, or internet website profiles or

locations.