Confidentiality of Social Security Numbers
SSN Protection (1798.85)
Data security
Limits how businesses display and use Social Security numbers: no public posting, no printing on access cards or on most mailings, no requiring SSN transmission over unsecured connections or as a sole website login, and no selling SSNs.
- Where
- California
- Citation
- Cal. Civ. Code 1798.85-1798.89
- Status
- In force
- In force since
- 2002-07-01
- Last amended
- 2023-01-01
- Enforced by
- California Attorney General and local prosecutors; private plaintiffs
- People can sue
- Yes
- Penalties
- Not stated in 1798.85; remedies arise under general unfair competition law and related sections.
- Applies to
- Any person or entity (with phase-in provisions for health plans, insurers, and providers)
Practices it requires
- Do not sell, advertise for sale, or offer to sell an individual's SSN (release for marketing counts as a sale).Cal. Civ. Code 1798.85(a)(6)
Security duties
- Do not publicly post or display SSNs or print them on cards needed to access products or services.Cal. Civ. Code 1798.85(a)(1)-(2)
- Do not require an SSN to be sent over the internet unless the connection is secure or the number encrypted, or use it alone to log into a website.Cal. Civ. Code 1798.85(a)(3)-(4)
- Do not print SSNs on mailed materials unless required by law; never on postcards or visible through envelopes.Cal. Civ. Code 1798.85(a)(5)
- Do not encode or embed an SSN in a card or document (barcode, chip, magnetic strip) in place of removing it.Cal. Civ. Code 1798.85(g)
Sources
Checked against these sources on 2026-09-25 by research agent (Claude), primary sources.
Unverified: Original effective date (July 1, 2002, SB 168) and remedies for this title are from background knowledge; private right of action status not verified in statute text fetched.
Research reference, not legal advice.