Business and Professions Code section 22948.30
(a)
“Account manager” means a person or entity that provides an individual an internet-based or app-based user account, or a third party that manages those user accounts on behalf of that person or entity, that has authority to make decisions regarding user access to those user accounts.(b)
(1)“Connected device” means any device, or other physical object that is capable of connecting to the internet, directly or indirectly, and that is assigned an internet protocol address or Bluetooth address or enables a person to remotely obtain data from or send commands to a connected device or account, which may be accomplished through a software application that is designed to be operated on a mobile device, computer, or other technology.(2)
“Connected device” does not include either of the following:(A)
Peripheral or component devices that are solely dependent on a primary connected device for internet connectivity and that cannot be independently accessed, remotely disabled, or disconnected by a user or service provider.(B)
A connected device that is more than 10 years old or is no longer supported by the account manager.(c)
(1)“Covered act” means conduct that constitutes any of the following:(A)
A crime described in Chapter 8 (commencing with Section 236) of Title 8 of Part 1 of the Penal Code.(B)
A crime described in Chapter 1 (commencing with Section 261), Chapter 2 (commencing with Section 270), Chapter 2.5 (commencing with Section 273.8), Chapter 4 (commencing with Section 277), Chapter 5 (commencing with Section 281), Chapter 5.5 (commencing with Section 290), Chapter 7.5 (commencing with Section 311), Chapter 7.6 (commencing with Section 313), or Chapter 8 (commencing with Section 314) of Title 9 of Part 1 of the Penal Code.(C)
An act under federal law, tribal law, or the Uniform Code of Military Justice that is similar to an offense described in subparagraph (A), (B), (D), or (E).(D)
Domestic violence, as defined in Section 6211 of the Family Code.(E)
A misdemeanor described in subdivision (e) of Section 243 of the Penal Code.(2)
Nothing in paragraph (1) shall be construed to require a criminal conviction or any other determination of a court in order for conduct to constitute a covered act.(d)
“Device access” means the ability to remotely control a connected device, remotely change the characteristics of a connected device, or remotely view or manipulate data collected by or through a connected device, by accessing a user account or accounts associated with the connected device. Acts that require device access include, but are not limited to, remotely manipulating an audio system, security system, light fixture, or other home appliance or fixture.(e)
“Device protection request” means a request by a survivor to terminate or disable a perpetrator’s access to a connected device or account, including, but not limited to, the ability of a person to obtain data from or send commands to a connected device or account.(f)
“Perpetrator” means an individual who has committed or allegedly committed a covered act against a survivor or an individual under the care of a survivor.(g)
“Survivor” means an individual who has had a covered act committed, or allegedly committed, against the individual, or who cares for another individual against whom a covered act has been committed or allegedly committed, provided that the individual providing care did not commit or allegedly commit the covered act.(h)
“User account or account” means an account or other means by which a person enrolls in or obtains access to a connected device or online service.
Source:
Section 22948.30, https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=BPC§ionNum=22948.30. (updated Jan. 1, 2026; accessed Dec. 15, 2025).
