California Anti-Phishing Act

California has a number of formal acts in statute. Business and Professions Code Division 8, Chapter 33 provides the Anti-Phishing Act of 2005, which is contained in Sections 18400 to 22949.51. Chapter 33 was added in 2005 by Chapter 437. Section 22948 provides the Act’s name.

Section 22948.1 provides definitions for the following terms: “electronic mail message”; “identifying information”; “Internet”; and, “web page.” Section 22948.2 makes it unlawful for any person, by means of a Web page, electronic mail message, or otherwise through use of the Internet, to solicit, request, or take any action to induce another person to provide identifying information by representing itself to be a business without the authority or approval of the business.

Section 22948.3 authorizes certain persons to bring an action against a person who violates or is in violation of the above section. An action brought under this paragraph may seek to recover the greater of actual damages or $500,000. In addition, the Attorney General or a district attorney may bring an action against a person who violates or is in violation of the above section to enjoin further violations and to recover a civil penalty of up to $2,500 per violation.