California Identity Theft Laws: Penal Code 530.5 and Your Rights

California's identity theft law, Penal Code § 530.5, is largely a "wobbler": for most of its subdivisions, prosecutors and courts can charge and sentence the offense as either a misdemeanor or a felony, with the choice turning on the specific subdivision charged, the defendant's prior record, and case severity, not on a dollar-amount line the way California's grand theft law works. One subdivision is the exception: a first-offense, under-10-victims possession charge under § 530.5(c)(1) is a flat misdemeanor with no felony option at all. California backs the criminal statute with some of the strongest victim rights in the country: a court process to be declared factually innocent, a statewide registry that protects you from being repeatedly misidentified as an offender, a free credit freeze for children under 16, and a dedicated civil damages statute.

This page covers § 530.5's offenses and penalties, the factual-innocence and registry process, your right to fraudulent application records, the minor freeze right, and California's civil remedy for identity theft. For the broader picture, see our identity theft laws hub and our guide to reporting identity theft.

California's Identity Theft Statute: The Wobbler

Penal Code § 530.5(a) makes it a crime for a person to willfully obtain another person's personal identifying information and use that information for any unlawful purpose, including to obtain, or attempt to obtain, credit, goods, services, real property, or medical information without that person's consent. "Personal identifying information," defined in the cross-referenced § 530.55, covers a broad list: name, address, phone number, date of birth, mother's maiden name, health insurance and taxpayer and school ID numbers, driver's license number, Social Security number, place of employment and employee ID number, PIN and bank account numbers, passport number, alien registration number, and credit or debit card numbers.

Subdivision (a), the base use offense, and subdivision (d)(1), the sale/transfer offense, both carry the identical punishment clause: a fine, imprisonment in county jail not to exceed one year, or both, or imprisonment under the felony realignment provisions of Penal Code § 1170(h). This is what makes those subdivisions a classic wobbler. The base possession offense under (c)(1), by contrast, a first offense involving fewer than 10 victims' information, is a flat misdemeanor: a fine, imprisonment in county jail not to exceed one year, or both, with no felony option at all. Unlike grand theft, which uses a specific $950 dollar line to separate misdemeanor from felony, § 530.5 has no such threshold anywhere in the statute; where a wobbler does apply, whether a given case is charged and sentenced as a misdemeanor or a felony turns on the subdivision charged, the defendant's priors, and the severity of the conduct, not on the dollar amount involved. § 530.5 was last amended in 2011 by AB 109, effective April 2011 and operative that October, with no amendment since.

The Possession and Sale/Transfer Offenses

Beyond the base use offense, § 530.5(c) separately criminalizes acquiring or retaining possession of another person's personal identifying information with intent to defraud, a distinct "possession" offense that does not require the information to have actually been used yet. The base version of this possession offense, subdivision (c)(1), covering a first offense involving fewer than 10 victims' information, is a flat misdemeanor with no felony option at all: a fine, imprisonment in county jail not to exceed one year, or both. The felony/wobbler exposure for possession only attaches once the defendant has a prior § 530.5 conviction, under (c)(2), or the offense involves 10 or more other people's information, under (c)(3); those two subdivisions add the Penal Code § 1170(h) felony option on top of the same fine/jail punishment. Subdivision (d) criminalizes selling, transferring, or conveying another person's identifying information with intent to defraud, with an aggravated version under (d)(2) for selling, transferring, or conveying information known to be used to commit identity theft. Subdivision (d)(2) is the one exception to the wobbler structure among the felony-eligible subdivisions: it omits the straight-misdemeanor option entirely, leaving only a felony or a fine.

Petitioning for a Court Determination of Factual Innocence

A person who reasonably believes they are a victim of identity theft may petition the court for an expedited judicial determination of factual innocence under Penal Code § 530.6. If the court finds no reasonable cause to believe the petitioner committed the offense, it "shall find the victim factually innocent," and may order the victim's name and identifying information deleted, sealed, or specially labeled in public court records, files, and indexes. This is a meaningful protection for anyone whose name has already been attached to a criminal case because a thief used their identity during an arrest or citation.

California's Statewide Identity Theft Registry

Building on the factual-innocence process, Penal Code § 530.7 requires the California Department of Justice to establish and maintain a statewide database of confirmed identity theft victims, built from the § 530.6 court order and fingerprint verification against DMV records. Law enforcement, victims, and authorized representatives can confirm victim status through a toll-free number, which helps prevent a victim from being repeatedly stopped, questioned, or misidentified as the offender in future encounters with police.

Getting Fraudulent Application Records From a Business

Under Penal Code § 530.8, a victim who presents either a copy of a police report made under § 530.6 or a signed and submitted FTC identity theft report, a police report is not the only qualifying document, along with the identifying information used in the fraudulent application, is entitled to receive copies of all paper, telephone, or electronic application and authorization records the defrauded business holds, free of charge, within 10 business days. A business that fails to comply faces a statutory penalty of $100 per day of noncompliance, plus the victim's reasonable attorney's fees, under § 530.8(d)(2).

Free Credit Freezes for Minors Under 16

California has its own protected-consumer minor credit freeze law, Civil Code §§ 1785.11.9 through 1785.11.11, distinct from and predating the federal baseline. § 1785.11.9, effective January 2017, sets the threshold at a consumer under 16 years of age at the time the freeze request is made, and requires a credit reporting agency to create a file and freeze it immediately, even if the child does not have one yet. To place the freeze, a parent or guardian contacts all three national bureaus with a written request and proof of their relationship to the child, such as a birth certificate or Social Security card copy, government ID, and, for a non-parent guardian, court documentation. Under Civil Code § 1785.11.11(d), the bureau has 30 days after receiving a complying request to place the freeze, and must send written confirmation to the address on file within 10 days of placing it, so plan for a wait measured in weeks rather than days. On cost, § 1785.11.11(i) caps any fee at $10 per placement or removal and bars a fee entirely where the request includes an identity theft report, where the protected consumer is under 16 and already has a credit file, or where the protected consumer is in foster care; separately, federal law has made security freezes free at all three national bureaus since 2018. Because California's law took effect roughly a year before the federal Economic Growth, Regulatory Relief, and Consumer Protection Act added the equivalent federal right in 2018, it gives California residents an independently enforceable state-law right on top of the federal floor, not a right that merely duplicates it.

California's Civil Remedy for Identity Theft Victims

California has a dedicated civil identity theft statute, the Consumer Protection Against Identity Theft provisions at Civil Code §§ 1798.92-1798.97. § 1798.92 defines a "victim of identity theft" as a person whose personal identifying information was used without authorization to obtain credit, goods, services, money, or property, who did not use or possess what was obtained, and who has submitted an FTC identity theft report or filed a police report under Penal Code § 530.5. § 1798.93 lets that victim bring an action, on a preponderance-of-the-evidence standard, to obtain a declaration of non-obligation, voiding of any security interest, an injunction against further collection, dismissal of the claim, actual damages, and attorney's fees and costs.

A separate civil penalty of up to $30,000 exists, but it is meaningfully harder to reach than the remedies above: it requires clear-and-convincing evidence, and the victim must have given the claimant 30 or more days' written notice before suing, shown the claimant failed to investigate diligently, and shown the claimant pursued the claim anyway. Most victims will realistically reach the preponderance-standard declaratory and injunctive relief and actual damages described above, not the $30,000 penalty, which is reserved for a claimant that keeps pursuing a debt after being put squarely on notice. § 1798.92 was last amended in 2021 by AB 430, effective January 1, 2022, with no newer amendment found. Separately, Penal Code § 530.8(d)(2) provides its own $100-per-day penalty against a business that unlawfully withholds fraudulent-application records from a verified victim, described above.

Reporting to the California Attorney General

The California Department of Justice runs a dedicated identity theft portal at oag.ca.gov/idtheft, including step-by-step guidance for freezing a child's credit and general victim self-help resources, such as recovery steps, credit bureau contacts, and a link to the state's Identity Theft Registry described above. Consistent with Penal Code § 530.7, the DOJ separately maintains that statewide database letting verified victims and law enforcement confirm victim status by phone.

Federal Rights That Apply in Every State

On top of California's own strong statutory framework, every identity theft victim also has federal rights that do not depend on state law. IdentityTheft.gov, run by the FTC, is a free national recovery site that builds a personal recovery plan once you describe what happened. Federal law has made both credit freezes and fraud alerts free at all three bureaus since 2018, under 15 U.S.C. § 1681c-1, and 15 U.S.C. § 1681c-2 (FCRA § 605B) requires a credit bureau to block fraudulent information from your report within 4 business days of receiving your documentation. See our guides to reporting identity theft and credit freeze vs. fraud alert for the full mechanics of both.

As of this session, no 2025-26 amendment to Penal Code § 530.5 has been found; its official amendment-history note still shows the 2011 AB 109 amendment as the most recent one. Civil Code § 1798.92's amendment-history note likewise shows the 2021 AB 430 amendment, effective January 1, 2022, as its most recent, with nothing newer identified.

Information last verified on 2026-08-13, drawn directly from Penal Code §§ 530.5 through 530.8, Civil Code §§ 1785.11.9 and 1798.92-1798.93, and the California Department of Justice's identity theft page. This article has not yet been reviewed by a licensed lawyer.

Related Resources

• Identity Theft Laws: Federal Rules and State Penalties
• How to Report Identity Theft
• Credit Freeze vs. Fraud Alert
• Child Identity Theft: Warning Signs and the Minor Freeze Right

---

Last updated: 2026-08-13.

Frequently Asked Questions

What is California's identity theft statute?

Penal Code § 530.5(a) makes it a crime to willfully obtain another person's personal identifying information and use it for any unlawful purpose, including to obtain credit, goods, services, real property, or medical information without consent. Related subdivisions criminalize possessing or selling stolen identifying information with intent to defraud.

Is identity theft a felony or misdemeanor in California?

It depends on the subdivision. Most of Penal Code § 530.5, including the base use offense (a) and the sale/transfer offense (d)(1), is a wobbler: a fine, up to one year in county jail, or a felony sentence, decided by the subdivision charged, prior record, and case severity, not by a specific dollar-loss threshold. The base possession offense under (c)(1), a first offense involving fewer than 10 victims, is a flat misdemeanor with no felony option; that felony exposure only attaches with a prior § 530.5 conviction, (c)(2), or 10 or more victims, (c)(3). The aggravated sale offense under (d)(2) runs the other way, with no straight misdemeanor option at all.

How do I get declared factually innocent of identity theft charges someone else caused?

Petition the court under Penal Code § 530.6. If the court finds no reasonable cause to believe you committed the offense, it must find you factually innocent and may order your information deleted, sealed, or labeled in public court records.

Can I get copies of the fraudulent application a thief used in California?

Yes. Under Penal Code § 530.8, a victim who provides a police report or a signed FTC identity theft report, plus the identifying information used, is entitled to free copies of the business's application records within 10 business days. Noncompliance carries a $100-per-day penalty plus reasonable attorney's fees under § 530.8(d)(2).

Can I freeze my child's credit for free in California?

Yes. California's own law, Civil Code § 1785.11.9, lets a parent or guardian freeze a child under 16's credit file even before the child has one, and predates the equivalent federal right by about a year. Civil Code § 1785.11.11 gives the bureau 30 days to place the freeze and 10 days after that to confirm it in writing, and federal law has made security freezes free at all three national bureaus since 2018.

Can I sue someone for identity theft in California?

Yes. Civil Code §§ 1798.92-1798.97 let a confirmed identity theft victim sue for a declaration of non-liability, an injunction, actual damages, and attorney's fees on a preponderance-of-the-evidence standard. A harder-to-reach $30,000 penalty is available only with clear-and-convincing evidence and after 30 days' written notice to the claimant.