CA AB2402

Prohibits cannabis licensees from disclosing a consumer's personal information to third parties except as necessary for payment processing or with consumer consent.

Classifies identification cards issued to qualified medical marijuana patients under Section 11362.71 of the Health and Safety Code as "medical information" under the Confidentiality of Medical Information Act, prohibiting licensee disclosure except for official government duties or to software contractors.

Classifies information contained in physician recommendations for cannabis use (including patient name, address, medical condition, and primary caregiver information) as "medical information" under the Confidentiality of Medical Information Act with the same disclosure restrictions.

Deems cannabis licensees that receive patient identification cards or physician recommendation information to be healthcare providers subject to Confidentiality of Medical Information Act requirements and penalties for improper disclosure.

Prohibits licensees from discriminating against consumers or denying services because the consumer refused to consent to disclosure of nonpublic personal information to unrelated third parties.