California Identity Theft Laws: Penal Code 530.5 and Your Rights

California's identity theft law, Penal Code § 530.5, is largely a "wobbler": for most of its subdivisions, prosecutors and courts can charge and sentence the offense as either a misdemeanor or a felony, with the choice turning on the specific subdivision charged, the defendant's prior record, and case severity, not on a dollar-amount line the way California's grand theft law works. One subdivision is the exception: a first-offense, under-10-victims possession charge under § 530.5(c)(1) is a flat misdemeanor with no felony option at all. California backs the criminal statute with some of the strongest victim rights in the country: a court process to be declared factually innocent, a statewide registry that protects you from being repeatedly misidentified as an offender, a free credit freeze for children under 16, and a dedicated civil damages statute.

This page covers § 530.5's offenses and penalties, the factual-innocence and registry process, your right to fraudulent application records, the minor freeze right, and California's civil remedy for identity theft. For the broader picture, see our identity theft laws hub and our guide to reporting identity theft.

California's Identity Theft Statute: The Wobbler

Penal Code § 530.5(a) makes it a crime for a person to willfully obtain another person's personal identifying information and use that information for any unlawful purpose, including to obtain, or attempt to obtain, credit, goods, services, real property, or medical information without that person's consent. "Personal identifying information," defined in the cross-referenced § 530.55, covers a broad list: name, address, phone number, date of birth, mother's maiden name, health insurance and taxpayer and school ID numbers, driver's license number, Social Security number, place of employment and employee ID number, PIN and bank account numbers, passport number, alien registration number, and credit or debit card numbers.

Subdivision (a), the base use offense, and subdivision (d), the sale/transfer offense, both carry the identical punishment clause: a fine, imprisonment in county jail not to exceed one year, or both, or imprisonment under the felony realignment provisions of Penal Code § 1170(h). This is what makes those subdivisions a classic wobbler. The base possession offense under (c)(1), by contrast, a first offense involving fewer than 10 victims' information, is a flat misdemeanor: a fine, imprisonment in county jail not to exceed one year, or both, with no felony option at all. Unlike grand theft, which uses a specific $950 dollar line to separate misdemeanor from felony, § 530.5 has no such threshold anywhere in the statute; where a wobbler does apply, whether a given case is charged and sentenced as a misdemeanor or a felony turns on the subdivision charged, the defendant's priors, and the severity of the conduct, not on the dollar amount involved. § 530.5 was last amended in 2011 by AB 109, effective April 2011 and operative that October, with no amendment since.

The Possession and Sale/Transfer Offenses

Beyond the base use offense, § 530.5(c) separately criminalizes acquiring or retaining possession of another person's personal identifying information with intent to defraud, a distinct "possession" offense that does not require the information to have actually been used yet. The base version of this possession offense, subdivision (c)(1), covering a first offense involving fewer than 10 victims' information, is a flat misdemeanor with no felony option at all: a fine, imprisonment in county jail not to exceed one year, or both. The felony/wobbler exposure for possession only attaches once the defendant has a prior § 530.5 conviction, under (c)(2), or the offense involves 10 or more other people's information, under (c)(3); those two subdivisions add the Penal Code § 1170(h) felony option on top of the same fine/jail punishment. Subdivision (d) criminalizes selling, transferring, or conveying another person's identifying information with intent to defraud, with an aggravated version under (d)(2) for selling, transferring, or conveying information known to be used to commit identity theft. Subdivision (d)(2) is the one exception to the wobbler structure among the felony-eligible subdivisions: it omits the straight-misdemeanor option entirely, leaving only a felony or a fine.

Petitioning for a Court Determination of Factual Innocence

A person who reasonably believes they are a victim of identity theft may petition the court for an expedited judicial determination of factual innocence under Penal Code § 530.6. If the court finds no reasonable cause to believe the petitioner committed the offense, it "shall find the victim factually innocent," and may order the victim's name and identifying information deleted, sealed, or specially labeled in public court records, files, and indexes. This is a meaningful protection for anyone whose name has already been attached to a criminal case because a thief used their identity during an arrest or citation.

California's Statewide Identity Theft Registry

Building on the factual-innocence process, Penal Code § 530.7 requires the California Department of Justice to establish and maintain a statewide database of confirmed identity theft victims, built from the § 530.6 court order and fingerprint verification against DMV records. Law enforcement, victims, and authorized representatives can confirm victim status through a toll-free number, which helps prevent a victim from being repeatedly stopped, questioned, or misidentified as the offender in future encounters with police.

Getting Fraudulent Application Records From a Business

Under Penal Code § 530.8, a victim who presents either a copy of a police report made under § 530.6 or a signed and submitted FTC identity theft report, a police report is not the only qualifying document, along with the identifying information used in the fraudulent application, is entitled to receive copies of all paper, telephone, or electronic application and authorization records the defrauded business holds, free of charge, within 10 business days. A business that fails to comply faces a statutory penalty of $100 per day of noncompliance, plus the victim's attorney's fees, under § 530.8(f).

Free Credit Freezes for Minors Under 16

California has its own protected-consumer minor credit freeze law, Civil Code §§ 1785.11.9 through 1785.11.11, distinct from and predating the federal baseline. § 1785.11.9, effective January 2017, sets the threshold at a consumer under 16 years of age at the time the freeze request is made, and requires a credit reporting agency to create a file and freeze it immediately, even if the child does not have one yet. To place the freeze, a parent or guardian contacts all three national bureaus with a written request and proof of their relationship to the child, such as a birth certificate or Social Security card copy, government ID, and, for a non-parent guardian, court documentation. The bureau must process the request within 3 business days and confirm it in writing within 5 business days, with no fee. Because California's law took effect roughly a year before the federal Economic Growth, Regulatory Relief, and Consumer Protection Act added the equivalent federal right in 2018, it gives California residents an independently enforceable state-law right on top of the federal floor, not a right that merely duplicates it.

California's Civil Remedy for Identity Theft Victims

California has a dedicated civil identity theft statute, the Consumer Protection Against Identity Theft provisions at Civil Code §§ 1798.92-1798.97. § 1798.92 defines a "victim of identity theft" as a person whose personal identifying information was used without authorization to obtain credit, goods, services, money, or property, who did not use or possess what was obtained, and who has submitted an FTC identity theft report or filed a police report under Penal Code § 530.5. § 1798.93 lets that victim bring an action, on a preponderance-of-the-evidence standard, to obtain a declaration of non-obligation, voiding of any security interest, an injunction against further collection, dismissal of the claim, actual damages, and attorney's fees and costs.

A separate civil penalty of up to $30,000 exists, but it is meaningfully harder to reach than the remedies above: it requires clear-and-convincing evidence, and the victim must have given the claimant 30 or more days' written notice before suing, shown the claimant failed to investigate diligently, and shown the claimant pursued the claim anyway. Most victims will realistically reach the preponderance-standard declaratory and injunctive relief and actual damages described above, not the $30,000 penalty, which is reserved for a claimant that keeps pursuing a debt after being put squarely on notice. § 1798.92 was last amended in 2022 by AB 430, with no newer amendment found. Separately, Penal Code § 530.8(f) provides its own $100-per-day penalty against a business that unlawfully withholds fraudulent-application records from a verified victim, described above.

Reporting to the California Attorney General

The California Department of Justice runs a dedicated identity theft portal at oag.ca.gov/idtheft, including step-by-step guidance for freezing a child's credit and general victim self-help resources, such as recovery steps, credit bureau contacts, and a link to the state's Identity Theft Registry described above. Consistent with Penal Code § 530.7, the DOJ separately maintains that statewide database letting verified victims and law enforcement confirm victim status by phone.

Federal Rights That Apply in Every State

On top of California's own strong statutory framework, every identity theft victim also has federal rights that do not depend on state law. IdentityTheft.gov, run by the FTC, is a free national recovery site that builds a personal recovery plan once you describe what happened. Federal law has made both credit freezes and fraud alerts free at all three bureaus since 2018, under 15 U.S.C. § 1681c-1, and 15 U.S.C. § 1681c-2 (FCRA § 605B) requires a credit bureau to block fraudulent information from your report within 4 business days of receiving your documentation. See our guides to reporting identity theft and credit freeze vs. fraud alert for the full mechanics of both.

As of this session, no 2025-26 amendment to Penal Code § 530.5 has been found; its official amendment-history note still shows the 2011 AB 109 amendment as the most recent one. Civil Code § 1798.92's amendment-history note likewise shows the 2022 AB 430 amendment as its most recent, with nothing newer identified.

Information last verified on 2026-08-13, drawn directly from Penal Code §§ 530.5 through 530.8, Civil Code §§ 1785.11.9 and 1798.92-1798.93, and the California Department of Justice's identity theft page. This article has not yet been reviewed by a licensed lawyer.

Related Resources

• Identity Theft Laws: Federal Rules and State Penalties
• How to Report Identity Theft
• Credit Freeze vs. Fraud Alert
• Child Identity Theft: Warning Signs and the Minor Freeze Right

---

Last updated: 2026-08-13.