Keypoint: The California legislature closed its 2024 session by passing five privacy-related bills and four AI-related bills.
On Saturday, August 31, the California legislature closed its 2024 session. During the past calendar year, we tracked numerous privacy and AI-related bills with fourteen of them passing out of their chamber of origin prior to the legislative deadline. For the past month, we have been tracking thirteen of those bills with weekly updates (the fourteenth bill already having passed through the legislature). Of the six privacy-related bills we have been tracking, five ultimately passed the legislature during the final week of the session. Four of the seven AI-related bills also passed.
The below article first provides a summary of the bills that passed during the final week of the session. The article then provides an overview of all fourteen bills.
1. What’s New
It was an extremely busy week for both chambers as lawmakers worked until the final day of the session to pass numerous privacy and AI-related bills. Lawmakers ultimately passed the following five privacy-related bills:
AB 3048 (opt-out preference signals) – Among other provisions, the bill prohibits a business from developing or maintaining a browser that does not include a setting that enables a consumer to send an opt-out preference signal to businesses with which the consumer interacts.
AB 1949 (kid’s privacy) – Amends the CCPA’s children’s privacy provisions to provide that a business cannot collect, sell, or share the personal information of a child ages 13 to 17 without the child’s consent or, for children below 13, without a parent or guardian’s consent. A business must have actual knowledge or willfully disregard the consumer’s age to violate the provision.
SB 1223 and AB 1008 (neural data / personal information and AI systems) – Amend the CCPA to add neural data as an element of sensitive personal information. Neural data is defined as “information that is generated by measuring the activity of a consumer’s central or peripheral nervous system, and that is not inferred from nonneural information.” Also amend the CCPA’s definition of personal information to specify that personal information can exist in various formats, including “artificial intelligence systems that are capable of outputting personal information.”
AB 1824 (recognition of prior opt-outs in M&A deals) – Amends the CCPA to provide that a business to which another business transfers the personal information of a consumer as an asset that is part of a merger, acquisition, bankruptcy, or other transaction in which the transferee assumes control of all of, or part of, the transferor shall comply with a consumer’s opt-out request. The bill also contains the kid’s privacy provisions in AB 1949.
As we previously reported, AB 2877 (use of personal information with AI systems) died in the Senate, and AB 3286 (monetary thresholds) already became law.
Lawmakers also passed the following four AI-related bills:
SB 1047 (“Safe and Secure Innovation for Frontier Artificial Intelligence Act”) – The bill regulates the largest artificial intelligence models. It has been the subject of extensive controversy and is a potential candidate for a governor’s veto.
AB 2013 (generative AI training data transparency) – Provides that developers of generative artificial intelligence systems or services must, prior to making their systems or services publicly available to Californians, post on their website documentation regarding the data used to train the system or service. A “developer” is defined as “a person, partnership, state or local government agency, or corporation that designs, codes, produces, or substantially modifies an artificial intelligence system or service for use by members of the public.”
AB 2885 (definition of AI) – Amends existing California law to define artificial intelligence as “an engineered or machine-based system that varies in its level of autonomy and that can, for explicit or implicit objectives, infer from the input it receives how to generate outputs that can influence physical or virtual environments.”
SB 942 (California AI Transparency Act) – Creates transparency obligations for persons that create, code, or otherwise produce generative artificial intelligence systems that have over one million monthly visitors or users and are publicly accessible within California’s geographic boundaries. The bill defines “generative artificial intelligence system” as “an artificial intelligence that can generate derived synthetic content, including text, images, video, and audio, that emulates the structure and characteristics of the system’s training data.”
The following three AI-related bills did not pass the legislature:
AB 2930 (algorithmic discrimination) died in the Senate after being ordered to the inactive file. The bill sought to regulate the use of artificial intelligence in high-risk processing activities. It was originally similar in scope to the Colorado AI Act but was then narrowed to apply only to employment-related decisions.
AB 3211 (provenance, authenticity and watermarking standards) died in the Senate after being ordered to the inactive file.
AB 1791 (Digital Content Provenance for Social Media Platforms) died in the Senate. The bill would have required social media platforms to redact personal provenance data from content uploaded by a user but prohibit platforms from redacting system provenance data from such content (with exceptions).
All of the bills that passed the legislature will now move to Governor Newsome for consideration. The Governor has until September 30 to consider the bills.
2. Summary and Current Status of Bills
Privacy Bill Developments
AB 2877 (Use of Personal Information with AI)
Summary: The bill amends the CCPA to prohibit a developer from using a consumer’s personal information to train or fine-tune an artificial intelligence system or service unless the consumer or the consumer’s parent or guardian has affirmatively authorized such use.
Current Status: The bill died in the Senate.
AB 3048 (Opt-Out Preference Signals)
Summary: The bill prohibits businesses from developing or maintaining a browser that does not include a setting that enables a consumer to send an opt-out preference signal to a business with which the consumer interacts through the browser. The bill also prohibits businesses from developing or maintaining a mobile operating system through which a consumer interacts with a business that does not include a setting that enables the consumer to send an opt-out preference signal to that business.
Current Status: The Assembly concurred in the Senate amendments on August 28. The bill’s author, Assemblymember Lowenthal, summarized the amendments as “clarifying and technical in nature, delaying the implementation by one year” to January 1, 2026. This marks the official passage of the bill, which will now move to engrossing and enrolling, where it will “engross” all amendments that have been made into the final “enrolled” version of the bill to present to the governor.
AB 1949 (Kid’s Privacy)
Summary: The bill amends the CCPA to prohibit businesses from collecting, selling, sharing, using or disclosing the personal information of kid’s ages 13 to 17 without the kid’s consent or, for children under 13, without parental/guardian consent. A business must have actual knowledge that the consumer is below 18 or 13. A business that willfully disregards the consumer’s age is deemed to have actual knowledge. In addition, a business must treat a consumer as under 18 years of age if the consumer, through a platform, technology, or mechanism, transmits a signal indicating that the consumer is less than 18 years of age.
Current Status: The bill’s amendments passed the Senate, which were then unanimously concurred in by the Assembly on August 29 marking the final passage of the bill. It will now move on to engrossing and enrolling. While in the Senate, Senator Wilk noted in its first reading that while there are federal and California state laws already in place which provide protections for children’s data, “there are still gaps in the law that allow businesses to collect, exploit, and monetize children’s data on a massive scale.”
SB 1223 (Neural Data)
Summary: The bill amends the CCPA’s definition of sensitive personal information to include neural data. It also includes provisions from AB 1008.
Current Status: The bill was read a third time and amended in the Assembly on August 27. On August 31, the Assembly passed the bill and the Senate concurred in the amendments thereby passing the bill. The bill was ordered to engrossing and enrolling.
AB 1008 (Personal Information and AI Systems)
Summary: Among other things, the bill amends the CCPA to specify that personal information can exist in various formats, including artificial intelligence systems that are capable of outputting personal information. As explained in the CPPA’s position paper written by Deputy Director of Policy & Legislation Maureen Mahoney: “[T]his bill seeks to underscore that personal information that exists in AI systems is still personal information, and therefore subject to existing CCPA obligations on businesses, such as data minimization, and the requirement to respond to consumer requests to access, delete, correct, and stop the sale/sharing of their personal information.” The bill also includes provisions from SB 1223.
Current Status: The bill was read for a second time on the Senate floor on August 26 and ordered to a third reading. On August 30, the Senate read the bill for a third time, passed it, and ordered it to the Assembly. On August 31, the Assembly concurred in the Senate amendments and ordered the bill to engrossing and enrolling.
AB 1824 (Recognition of Prior Opt-Outs in M&A Deals)
Summary: The bill amends the CCPA to require a business to which another business transfers the personal information of a consumer as an asset that is part of a merger, acquisition, bankruptcy, or other transaction in which the transferee assumes control of all or part of the transferor to comply with a consumer’s opt-out direction to the transferor. The bill also contains provisions from AB 1949.
Current Status: On August 28, the bill passed the legislature after the Assembly concurred in the Senate amendments. It will now proceed to engrossing and enrolling.
AB 3286 (Monetary Thresholds)
Summary: The bill authorizes the California Privacy Protection Agency to make changes to certain CCPA monetary thresholds. The bill also makes changes to the CCPA’s consumer privacy fund.
Current Status: Signed into law on July 15.
AI Bill Developments
AB 2930 (Algorithmic Discrimination)
Summary: The bill would have minimized algorithmic discrimination in a manner similar to Colorado’s recently passed CAIA by broadly prohibiting deployers and developers of automated decision tools from using these tools or making such tools available that result in algorithmic discrimination. On August 15, the bill was amended to narrow the bill to apply only to certain employment decisions (e.g., hiring or termination) and to no longer apply to the state government’s use of AI systems.
Current Status: The bill died in the Senate with it being ordered to the inactive file on August 31.
SB 1047 (“Safe and Secure Innovation for Frontier Artificial Intelligence Act”)
Summary: The bill would implement standards for the largest and most powerful AI models.
Current Status: The bill was read in the Assembly on August 28, where it received a strong bipartisan backing from Assemblymembers Bennett, Matthis, Wood, Zbur, and Muratsuchi. In summary, the Assemblymembers emphasized that the bill simply requires large companies to take precautions against critical harm caused by artificial intelligence. Additionally, they highlighted the inaction of the federal government on the issue and stated that as the only regulatory body that can currently impact AI, it is the responsibility of the state of California to take action. The bill then passed the Assembly and on August 29, its amendments were concurred in the Senate, marking the official passage of the bill. It will now proceed to enrolling and engrossing.
AB 3211 (Provenance, Authenticity and Watermarking Standards)
Summary: Among other provisions, the bill would require generative AI system providers to: (1) place watermarks containing provenance data into their AI generated content; (2) provide public tools or services that can determine whether a piece of content was created by the provider’s generative AI system; (3) conduct regular “red-teaming exercises” to test whether watermarks can be easily removed or fabricated; (4) publicly disclose the discovery of any vulnerability or failure in their generative AI system; and (5) make certain disclosures to users of the developer’s “conversational AI systems.”
Current Status: The bill died in the Senate.
AB 1791 (Digital Content Provenance for Social Media Platforms)
Summary: The bill would require social media platforms to redact personal provenance data from content uploaded by a user but prohibit platforms from redacting system provenance data from such content (with exceptions).
Current Status: The bill died in the Senate.
AB 2013 (Generative AI Training Data Transparency)
Summary: The bill would require developers of generative AI systems or services to post a high-level summary of the datasets used in the development of the system or service on their website, with certain details described in the bill. The bill would also require developers to disclose whether the system uses “synthetic data generation.”
Current Status: The bill passed the Senate on August 26. On August 27, it was read in the Assembly by its author, Assemblymember Irwin, who highlighted how the Senate amendments · “removed most opposition to the bill, [and] narrowed the bill to generative AI and limited it to systems and services released after January 2022. The bill still covers the most popular AI systems and services that Californians use, and is a building block as we continue to address many of the risks and great potential of AI.” The Assembly then concurred in the Senate amendments on August 28, marking the bill’s final passage. It will proceed to enrolling and engrossment.
AB 2885 (Definition of AI)
Summary: The bill would incorporate a new definition of “artificial intelligence” into existing California law.
Current Status: The Senate passed the bill on August 30 and the Assembly concurred in the Senate amendments on August 31, thus securing final passage of the bill out of the legislature. It will now move to engrossing and enrolling.
SB 942 (California AI Transparency Act)
Summary: Among other provisions, the bill would require a covered provider (a business that provides generative AI systems with one million monthly users on average) to create an AI detection tool that a person could use to identify what text, image, video, audio, or multimedia content was created by the provider’s generative AI system. Additionally, a covered provider would be required to include a visible disclosure that content is AI-generated for any image, text, video, or multimedia content created by its system.
Current Status: The bill passed the Assembly unanimously on August 28. It was read the next day in the Senate by its author, Senator Becker, who gave a brief summary of the bill and stated that the purpose of the Assembly amendments were to “delay implementation until 2026 and make clarifying changes to ensure technically feasible and reasonable timelines.” The Senate then concurred in the Assembly amendments, marking the official passage of the bill. It will now move to engrossing and enrolling.
[View source.]
