SB 50 creates a new California framework for “device protection requests” aimed at helping survivors of domestic violence, stalking, sexual assault, human trafficking, and related abuse cut off an abuser’s access to connected devices and associated online accounts. The bill defines covered “connected devices” broadly to include internet- or Bluetooth-enabled objects that can be remotely controlled or monitored through an account, while excluding certain peripheral devices and older or unsupported devices. It allows a survivor, or a designated representative, to ask an account manager to terminate or disable a perpetrator’s access, and requires the request to be processed within two business days once complete.
To make a request, the survivor must provide specified verification of the abuse or alleged abuse and proof of exclusive legal possession or control of the device, along with identification of the device and the person whose access is to be removed. Account managers must provide a secure, easy-to-use submission process, explain the process on their website or app, keep submitted information confidential, and not notify the perpetrator or disclose related account changes. If the account manager cannot directly disable access, it must instead provide clear instructions for a factory reset or similar method that removes all account holders, and the survivor is not responsible for charges incurred by the perpetrator after access is terminated.
The bill also creates enforcement mechanisms. Violations by account managers or perpetrators may be pursued through civil actions by injured persons or public prosecutors, with injunctions, civil penalties of up to $2,500 per violation per connected device, and attorney’s fees available to prevailing plaintiffs. The bill states that its remedies are cumulative, waives no rights, and is severable. It also exempts entities already covered by the federal Safe Connections Act of 2022 and certain vehicle-code-related systems, and it amends Family Code Section 6320 to clarify that “disturbing the peace” in domestic violence protective-order law includes conduct carried out through connected devices as defined in the bill.
The bill’s impact on state law is twofold: it adds a new chapter to the Business and Professions Code regulating account managers of connected devices, and it expands Family Code domestic violence protections to expressly include connected devices as tools of coercive control. It also creates a state-mandated local program finding because the bill allows device protection requests to include signed affidavits, which the digest says expands the crime of perjury. The measure is framed as a consumer-safety and survivor-protection law, but it also imposes compliance, confidentiality, and enforcement obligations on technology and device-account providers.
Overall sentiment around SB 50 appears strongly supportive and noncontroversial in the recorded votes: it advanced with unanimous or near-unanimous committee and floor votes, including 13-0, 6-0, 38-0, 79-0, and 40-0 votes at various stages. The bill’s findings emphasize the prevalence of technology-facilitated abuse and the need to help survivors regain autonomy and safety. No committee transcript objections are provided, but the structure of the bill suggests the main policy tension is between survivor access and the administrative burden on account managers, along with questions about documentation, privacy, and how quickly access must be terminated.
Notable points of contention likely center on the evidentiary requirements for a request, the breadth of the definition of connected device, and the operational burden on account managers to act within two business days while protecting confidentiality and avoiding notice to the perpetrator. Another possible issue is the bill’s treatment of alleged, not just adjudicated, abuse, since it does not require a criminal conviction or court determination for a covered act. The bill also raises implementation questions for devices shared by households, subscription-based accounts, and devices that may not support remote account changes, though the bill attempts to address those cases through factory-reset instructions and exclusions for unsupported or older devices.
SB 50 adds Chapter 35.5 to the Business and Professions Code to regulate connected-device account access in domestic violence and related abuse cases, and it amends Family Code Section 6320 to make clear that abuse through connected devices can constitute disturbing the peace for protective-order purposes. It creates a new civil enforcement scheme for survivors and public prosecutors, with injunctions, civil penalties, and attorney’s fees, while also imposing confidentiality, notice, and processing duties on account managers. The bill expressly excludes entities already covered by the federal Safe Connections Act of 2022 and certain vehicle-code systems, and it states that no state reimbursement is required.
The recorded legislative history shows overwhelmingly favorable sentiment. The bill passed committees and floor votes unanimously or nearly unanimously, including multiple 6-0, 13-0, 38-0, 79-0, and 40-0 votes, and it was ultimately chaptered. The bill’s findings and structure reflect a strong policy consensus that technology can be used to facilitate abuse and that survivors need a legal mechanism to regain control of connected devices and accounts.
The main areas of potential contention are practical and procedural rather than ideological: what documentation should be required to prove abuse or exclusive control of a device, how quickly account managers can comply, and how to protect privacy without tipping off the perpetrator. The bill also relies on allegations as well as documented abuse, which may raise due-process concerns for some stakeholders, and it places significant compliance obligations on device and account providers. Another possible point of dispute is the breadth of the definition of connected device and whether the bill could be difficult to implement for shared household devices, legacy products, or services with limited remote-access controls.