So what happens is the manufacturers are required to send CARB the ECU ID + Checksums of CARB approved ROM's. This is the same case for any aftermarket tuning company wanting CARB approval. So using OBD2 protocol, they can request the ECU ID as well as the checksums and cross reference against the list the manufacturers have sent in. If the checksums don't match, then the ROM has been modified. So if the stock ROM was flashed back on, the checksums would match once again. (As long as the ECU doesn't track reflashes and alters the checksum)
One potentially unfortunate situation CARB is in is the fact that if someone were to modify the OBD2 code within their ROM, they could just force it to report the stock checksum values by having it report a fixed value, rather than calculating the checksum value. So it's not a fool proof plan for them. But based on the fact that most tuners don't actually modify the code on their own (or can't with a lot of commercial software ), it shouldn't be too large of a concern? I guess only time will tell. But everyone's best bet is to just not move to California
