AB 2624 responds to targeted harassment of people who provide or receive immigration support by imposing legal barriers to public disclosure of their home and contact information and creating remedies for violations. The bill sets substantive privacy protections for designated immigration support services providers, volunteers, employees, and clients, and makes online publication of their personal information actionable.
The measure pairs an administrative program for substitute addresses with criminal penalties and a private right of action against people or entities who publish or trade protected personal information with intent to threaten or incite violence. The protections aim to reduce doxxing, threats, and courthouse or online targeting of organizations that assist immigrants.
At a Glance
What It Does
Creates a state‑administered address confidentiality program for people affiliated with immigration support facilities, authorizes the Secretary of State to act as mail and service agent, and allows covered individuals to use the program address in public records. Separately, the bill bans and penalizes online posting, sale, or solicitation of protected personal information or images when done to threaten or incite harm, and preserves a Section 230 carve‑out for platforms unless they intend to abet violence.
Who It Affects
Nonprofit immigration legal clinics, DOJ‑recognized entities, accredited representative sites, health centers offering immigration services, their staff, volunteers, and clients; the Secretary of State and local recordkeeping offices required to accept the substitute address; online platforms and operators who publish or monetize personal information.
Why It Matters
The bill extends the address confidentiality model beyond domestic‑violence contexts to a group facing targeted harassment, creating new procedural duties for public agencies and new liability exposures for individuals and internet publishers who weaponize personal data. Compliance, operational costs, and litigation risk will matter to service providers, public agencies, and platforms.
More articles like this one.
A weekly email with all the latest developments on this topic.
What This Bill Actually Does
AB 2624 defines a protected class of people connected to “designated immigration support services facilities” — a broad list that includes nonprofit offices, community legal clinics, accredited representative sites, law offices, and health care facilities that deliver immigration assistance. It establishes program definitions (addresses, images, personal information, harassment) and clarifies who counts as a covered provider, volunteer, employee, or client.
The bill requires applications for the program to be filed in person at community‑based assistance programs designated by the Secretary of State and to include an orientation meeting with a counselor. Applicants must supply documentation of their affiliation with a designated facility and a supporting statement showing a reasonable fear tied to that affiliation; acceptable proofs include a facility‑certified statement, a self‑certified statement, or a qualifying civil or workplace restraining order.
The Secretary of State may charge an application fee up to reasonable program costs and annual maintenance fees, but clients receiving services are exempt from fees.Once certified, a participant receives a substitute address designated by the Secretary of State that state and local agencies must accept as the participant’s address when creating, modifying, or maintaining public records, except where an agency has a bona fide statutory or administrative requirement for the actual address. The Secretary of State acts as agent for service of process and for mail handling: service delivered to the office is forwarded to the participant within three days, and first‑class governmental mail is forwarded.
The office may refuse to forward packages and is held harmless from liability for handling first‑class mail; records about participants are retained confidentially for three years after termination and then destroyed, subject to limited disclosure triggers.Certification mechanics include a four‑year term for most participants and a six‑month period for volunteers after their last volunteering date, with renewal procedures to be adopted by rule. The Secretary of State must accept applications beginning April 1, 2027, create a dedicated fund for administration, and produce annual and multi‑year reports to the Legislature with counts, mail forwarding metrics, alleged election misuse, and recommendations to improve efficiency.
The bill also advises participants on property and name‑change tools (using the program address on deeds, placing property in a revocable trust, or pursuing a name change) and provides a route to confidential voter registration.On the enforcement side, AB 2624 makes it unlawful to publicly post, display, sell, or trade the personal information or image of a covered person on internet sites or social media with the intent to incite or threaten imminent violent harm. Individuals whose information is disclosed can seek injunctive relief and attorney’s fees, and recover damages up to three times actual damages with a statutory floor of $4,000.
The bill further establishes criminal penalties for posting information with the intent that another imminently use it to commit violence: up to $10,000 fine and up to one year in county jail (or both), and if the conduct leads to bodily injury, the violator may face felony prosecution with higher fines. Interactive computer services retain Section 230 protections unless the provider intended to abet or cause bodily harm.
The Five Things You Need to Know
Applications must be completed in person at a community‑based assistance program designated by the Secretary of State and must include an orientation meeting with a counselor.
Most certified participants receive four‑year certifications; volunteers remain certified until six months after their last volunteering date unless earlier terminated.
The Secretary of State is designated as agent for service of process and must forward summonses, writs, and other process received to program participants within three days of receipt.
Civil remedies for unlawful online disclosure include injunctive relief, recovery of court costs and attorney’s fees, and monetary damages up to three times actual damages, but not less than $4,000.
Criminal penalties attach where online posting is made with the intent that another imminently use the information to commit a violent crime: up to $10,000 per violation and up to one year in county jail; acts that result in bodily injury can trigger felony charges and fines up to $50,000.
Section-by-Section Breakdown
Every bill we cover gets an analysis of its key sections.
Definitions and scope
This section sets the vocabulary that controls the rest of the chapter: what counts as an address, who qualifies as a designated immigration support services provider, what an image or personal information is, and how harassment is characterized. Those definitions are broad and deliberately inclusive — for example, facility types and a wide range of identifiers are enumerated — which expands the pool of eligible program participants and the kinds of data prohibited from disclosure.
Application, proof, fees, and certification
Applicants must apply in person at approved community‑based sites and meet with a counselor; they must show proof of affiliation with a covered facility and substantiate a fear tied to that affiliation using either a facility‑certified statement, a self‑certified statement, or a qualifying restraining order. The Secretary of State can charge fees not to exceed program costs but waives fees for clients; on approval, the office certifies participants and issues authorization. False attestations are criminalized as misdemeanors, which raises the evidentiary and deterrent stakes for applicants and facilities that provide certifications.
Certification duration, termination, retention, and voter confidentiality
The statute fixes certification terms (most participants: four years; volunteers: until six months after volunteering ends) and authorizes renewal rules. It lists multiple grounds for termination — expired certification, false application information, relocation without notice, nondeliverable forwarded mail, or undisclosed employment changes — and provides a 30‑business‑day appeal window. Records for terminated participants are confidential for three years and then destroyed; eligible program participants may also use confidential voter registration procedures.
Substitute address use, mail forwarding, and agency coordination
State and local agencies must accept the Secretary of State's designated address as a substitute in public records creation or maintenance unless the agency shows a bona fide statutory or administrative need for the actual address; the statute carves out certain records (e.g., vital records). The Secretary of State forwards first‑class governmental mail and acts as the official agent for service; the office may decline to forward packages. The bill requires the Secretary of State to administer the program alongside existing address confidentiality programs, designate assisting agencies and nonprofit partners, and to publish participant notices and reports to the Legislature.
Civil prohibitions and remedies for online disclosure
These sections bar the online posting, display, sale, or distribution of a program participant’s home address, personal information, or image when done to threaten or incite violence or after a written 'do not disclose' demand. They create a private right of action for injunctive relief, attorney’s fees, and damages (treble recovery with a $4,000 floor), and include a limited carve‑out for entities covered by Evidence Code Section 1070. The statute aims to give targeted individuals direct civil recourse against doxxers and marketers of personal data.
Criminal prohibitions and penalties
This section criminalizes online posting with the intent that another imminently use the information to commit violence against a covered person: it imposes monetary fines (up to $10,000 per violation), possible county jail time (up to one year), or both; conduct that causes bodily injury elevates the offense to a felony with higher fines (up to $50,000). The provision states it does not preclude prosecution under other laws and thus can be layered onto existing criminal charges.
This bill is one of many.
Codify tracks hundreds of bills on Privacy across all five countries.
Explore Privacy in Codify Search →Who Benefits and Who Bears the Cost
Every bill creates winners and losers. Here's who stands to gain and who bears the cost.
Who Benefits
- Designated immigration support services providers, volunteers, employees, and clients — they receive practical privacy tools (substitute address, mail forwarding, service through the Secretary of State) and legal remedies that reduce exposure to doxxing, threats, and targeted harassment.
- Nonprofit legal clinics and community organizations — the program offers institutional support to protect staff and clients, and facility‑certified statements provide a mechanism for facilities to vouch for threats faced by affiliates.
- Victims of doxxing and harassment — the private right of action and statutory damages create a direct enforcement path and financial deterrent against online publishers and data brokers who target protected individuals.
- Lawyers and civil‑rights organizations representing plaintiffs — the design of attorney’s‑fee awards and injunctive relief creates clearer avenues for litigation and potential business for counsel serving affected communities.
- County and state clerks wanting to reduce courthouse targeting — substitution of addresses for public records reduces the operational risk that harmful actors will locate attendees or staff via public filings.
Who Bears the Cost
- Secretary of State’s office — responsible for program administration, counselor designation, mail forwarding, acting as agent for service, rulemaking, and reporting; the bill authorizes fees but administrative startup and operational burdens fall largely on the office until appropriations and fee revenue cover costs.
- Local agencies and recording offices — must accept substitute addresses, adjust records workflows, and coordinate with the Secretary of State; some agencies may need software or procedural changes to prevent inadvertent disclosure.
- Online platforms, data brokers, and individuals who publish personal information — face new civil exposure and criminal risk when conduct crosses the intent thresholds; platforms will need to update abuse policies and moderation practices to manage takedown and legal requests.
- Small nonprofits and community partners — required to provide certified statements when supporting applicants may incur administrative, training, and reputational costs; false certification is criminalized, raising internal compliance stakes.
- Investigative journalists and some public‑interest researchers — while the bill includes carve‑outs, the threat of civil suits and the broad definitions of protected information may chill publication choices or impose additional legal review costs.
Key Issues
The Core Tension
The bill resolves a clear safety problem — public exposure of home addresses and identifying data — by sacrificing some transparency and imposing operational burdens: protecting privacy for vulnerable individuals requires substituting secretive addresses into public systems and creating liability for publication, which clashes with values of open records, freedom of expression, and administrative cost constraints; the central dilemma is choosing how much secrecy and enforcement weight society should give to safety at the expense of public access and platform immunity.
AB 2624 builds powerful protective tools, but several implementation and doctrinal wrinkles could dilute or complicate outcomes. The application proof rules hinge on a relatively short temporal window (threats within one year) and on evidence types — facility certifications, sworn statements, or restraining orders — that may be difficult for some victims to produce, particularly transient clients or those who avoid law enforcement.
The Secretary of State’s discretion to designate assistance sites and to determine reasonable fees, coupled with the start date and report deadlines, means practical access will depend on administrative decisions and budget choices.
On enforcement, the statute centers on intent: civil and criminal liability depends on publishing 'with the intent' to incite or to cause imminent harm, or posting with the intent that another imminently use it to commit violence. Proving specific intent against anonymous online actors is notoriously difficult and will require investigative resources or cooperation from platforms.
At the same time, the law preserves Section 230 immunity for interactive computer services unless the provider intended to abet harm, so major platforms will likely remain shielded in many routine cases. The tension between suppressing harmful doxxing and protecting lawful speech — including investigative reporting — will surface in litigation, especially around the bill’s exceptions for statutory agency needs and for persons covered by Evidence Code Section 1070.
Operationally, forwarding and handling mail raises logistics and liability questions: the office is held harmless for handling first‑class mail, but it may refuse packages, and returned or nondeliverable forwarded mail is a termination trigger that could re‑expose participants. Finally, the civil damages structure (treble damages with a $4,000 floor) and the criminal fines create significant deterrents but also invite contested suits where publishers claim public‑interest defenses; the statute’s broad definitions of personal information and image mean courts will be asked to draw lines on what constitutes protected, identifying data in the social‑media era.
Try it yourself.
Ask a question in plain English, or pick a topic below. Results in seconds.