The state of California has introduced a RFID privacy protection law called SB 31, effective 1 January 2009. The law was proposed by US Senator Joe Simitian and prohibits anyone from 'reading' information without the card holder's permission.

SB 31 is part of a package of consumer protection bills supported by the Consumer Federation of California, which went into effect on 1 January 2009. The law deals with cards issued by government agencies, health insurance companies, schools and others. According to the law, skimmers are punished by ‘imprisonment in a county jail for up to one year, a fine of not more than USD 1,500, or both that fine and imprisonment’. ‘Skimming’ is creating an unauthorised connection with an RFID tag in order to gain access to its data. Despite its useful applications, RFID technology has many privacy and security risks. When integrated into identification documents for example, information can be scanned off a RFID device from a short distance, without the holder’s knowledge that any information has been remotely transmitted or recorded from the RFID device. Without proper protections, unauthorised readers can read and skim the personal information stored on a device, such as a birth date, digital picture, or unique identifier number.