Recap: Understanding California’s latest wave of privacy & AI bills
By Andrew Moon
September 4, 2024•2 min read
In a marathon finish to the California Legislature in late August 2024, lawmakers sent nine bills to Governor Gavin Newsom’s desk for signature dealing with the handling of consumer data, and regulating artificial intelligence. This continues the trend of U.S. states not waiting for Congress to legislate on privacy and AI.
The bills covered the handling of opt-outs, children’s data, defining and assessing risk with AI models, and more. Now each has cleared both chambers in the legislature, Governor Newsom has 30 days to sign them into law or veto.
In a legislative livestream on September 4, Runway Strategies co-founder Dave Barmore and Transcend Field CPO Ron De Jesus reviewed the bills, and covered off on the implications for privacy teams.
Watch back the session below, and scroll down for a summary of each of the bills discussed.
Privacy-related bills
Opt-Out Preference Signals (AB 3048)
This bill would prohibit a business from developing or maintaining a browser or mobile device that does not include a setting that enables a consumer to send an opt-out preference signal to businesses with which the consumer interacts through the browser or device.
Recognition of Prior Opt-Outs in M&A Deals (AB 1824)
This bill would require a business to which another business transfers the personal information of a consumer as an asset that is part of a merger, acquisition, bankruptcy, or other transaction in which the transferee assumes control of all or part of the transferor to comply with a consumer's opt out direction to the transferor.
Children's Privacy (AB 1949)
This bill would prohibit a business from selling or sharing the personal information of a consumer if the business has actual knowledge that the consumer is less than 16 years of age, unless the consumer, or the consumers’ parent or guardian, as applicable, has affirmatively authorized the sale or sharing of the consumers’ personal information.
Neural Data (SB 1223)
This bill would define sensitive personal information, for purposes of the CCPA, to additionally include a consumers’ neural data, and would define neural data to mean information that is generated by measuring the activity of a consumers central or peripheral nervous system, and that is not inferred from non-neural information.
AI-related bills
Safe and Secure Innovation for Frontier Artificial Intelligence Act (SB 1047)
One of the most talked about AI bills in recent weeks, this bill would mandate that companies that spend $100 million to train an AI model or $10 million to modify one must test the model for its ability to enable cybersecurity or infrastructure attacks or the development of chemical, biological, radioactive, or nuclear weaponry.
Generative AI Training Data Transparency (AB 2013)
This bill would require that a generative AI system that is made available to Californians for use, post online documentation about how their systems are trained and what types of data are used.
Personal Information and AI Systems (AB 1008)
This bill would amend the CCPA’s definition of personal information to specify that personal information can exist in various formats, including “artificial intelligence systems that are capable of outputting personal information.”
Definition of Artificial Intelligence (AB 2885)
This bill would define the term AI to mean an engineered or machine-based system that varies in its level of autonomy and that can, for explicit or implicit objectives, infer from the input it receives how to generate outputs that can influence physical or virtual environments.
California AI Transparency Act (SB 942)
This bill would require a covered provider that 1) has over one million monthly visitors or users and 2) are publicly accessible within the state, to create and make available an AI detection tool at no cost to the user that meets certain criteria, including that the AI detection tool is publicly accessible.
We'll be keeping close watch on the passage of these bills into law as we approach the September 30 deadline.
By Andrew Moon