(1) Existing law, the Digital Financial Assets Law, prohibits a person, on or after July 1, 2026, from engaging in digital financial asset business activity, or holding itself out as being able to engage in digital financial asset business activity, with, or on behalf of, a resident, unless any of certain criteria are met, including that the person is licensed with the Department of Financial Protection and Innovation, as prescribed, or the person submits an application on or before July 1, 2026, and is awaiting approval or denial of that application. This bill would revise the above-described latter criterion to specify that the person submits a completed application, as provided. The Digital Financial Assets Law authorizes the Commissioner of Financial Protection and Innovation to issue a conditional license to an applicant who holds or maintains a license to conduct virtual currency business activity in the State of New York, as specified, provided the license was issued or approved no later than January 1, 2023. This bill would revise the above-described authorization to require that the license be issued or approved no later than January 1, 2025. (2) The Digital Financial Assets Law defines "digital financial asset business activity" to mean any of specified activities, including, among others, exchanging, transferring, or storing a digital financial asset, as specified, or exchanging one or more digital representations of value used within one or more online games, game platforms, or family of games, as provided. This bill would remove exchanging one or more digital representations of value used within one or more online games, game platforms, or family of games from the definition of "digital financial business activity." The bill would specify that a "digital financial asset" does not include, among other things, a transaction in which a merchant grants digital representations of value that primarily relate to an affinity or rewards program, as provided, or a digital representation of value issued by or on behalf of a publisher and used primarily within online games or game platforms and that is not otherwise a digital financial asset. The Digital Financial Assets Law declares that its provisions do not apply to specified activity, including by a person who does not receive compensation for providing digital financial asset products or services or for conducting financial asset business activity or that is engaged in testing products or services with the person's own funds. This bill would specify that the above-described exclusion includes a person who merely retains the ability to terminate, suspend, or interrupt a digital financial transaction solely to prevent unauthorized or fraudulent activity and who is not compensated for that service. The Digital Financial Assets Law prohibits a covered person from exchanging, transferring, or storing a digital financial asset that is a stablecoin or engaging in digital financial asset administration of a stablecoin, as specified, unless certain conditions are met. However, existing law authorizes a covered person to exchange, transfer, or store a stablecoin or engage in digital financial asset administration of that stablecoin, as specified, if the stablecoin is approved by the commissioner and complies with certain requirements, restrictions, or prohibitions established by the commissioner. This bill would repeal the above-described provisions related to stablecoins. (3) The Digital Financial Assets Law requires a licensee to submit an annual report, as provided, containing specified information, including a description of any data security breach or cybersecurity event of the licensee. Existing law requires a licensee to file with the department, as applicable, a report of, among other things, a change in the licensee's business for the conduct of its digital financial asset business activity with, or on behalf of, a resident that meets one of specified criteria, including that the proposed change might raise safety and soundness or operational concerns. This bill would revise the above-described annual report to instead include a description of any material data security breach or cybersecurity event of the licensee. The bill would revise the specified criteria in the requirement to file the above-described report of a change in the licensee's business to instead include that the proposed change might raise material safety and soundness or operational concerns. Before engaging in digital financial asset business activity with a resident, the Digital Financial Assets Law requires a covered person, defined as a person required to obtain a license pursuant to that law, to disclose, as provided, certain information, including the resident's right to at least 14 days' prior notice of specified changes that have a material impact on digital financial asset business activity with the resident, or the policies applicable to the resident's account. Existing law requires a covered exchange, as provided, to certify on a form provided by the department that the covered exchange has taken specified actions, except for any digital financial asset approved for listing on or before January 1, 2023. In a transaction for or with a resident, existing law prohibits the covered exchange from interjecting a third party between the covered exchange and the best market for the digital financial asset in a manner inconsistent with specified requirements. This bill would prohibit the 14-day notice requirement from applying to changes in terms, conditions, or policies that are reasonably necessary to address a risk of loss to the resident or covered person, to the extent that the change does not relate to the fee schedule. The bill would instead exclude from the above-described certification requirement a digital financial asset approved for listing on or before January 1, 2025. The bill would require a covered person to provide and make available an up-to-date description of the order execution practices of the covered person, as specified. The bill would exempt a transaction in which a resident receives stablecoin, as defined, in exchange for legal tender or bank or credit union credit from the above-described prohibition against interjecting a third party. The Digital Financial Assets Law requires an applicant, as provided, to create, and during licensure, maintain in a record specified policies and procedures. Existing law requires these policies and procedures be disclosed separately from other disclosures made available to a resident, as specified, except for, among other things, an adopted information security program or an operational security program. This bill would instead exclude from the above-described requirement to disclose separately from other disclosures programs with information that is sensitive to potential security risks, as specified. This bill would declare that it is to take effect immediately as an urgency statute.
The Digital Financial Assets Law, on or after July 1, 2026, prohibits a person from engaging in digital financial asset business activity or holding itself out as being able to engage in digital financial asset business activity, with or on behalf of a resident unless any of specified conditions is true. The law defines "digital financial asset" to mean a digital representation of value that is used as a medium of exchange, unit of account, or store of value, and that is not legal tender, whether or not denominated in legal tender and defines "digital financial asset business activity" to mean, among other similar things, exchanging, transferring, or storing a digital financial asset or engaging in digital financial asset administration, whether directly or through an agreement with a digital financial asset control services vendor. This bill, the Digital Financial Asset Banking Act, would generally regulate a bank or a credit union under the examination authority of the Department of Financial Protection and Innovation with respect to its provision of digital asset custody services, staking services, and digital asset transaction services, as those terms are defined, including by requiring certain disclosures to costumers and requiring certain financial safety measures. The bill would require a financial institution engaged in digital financial asset custody services to conduct an annual audit of its custodial activities and holdings that is either an independent audit or a review by the financial institution's board of directors for accuracy and signed be each board member under penalty of perjury. By expanding the scope of the crime of perjury, this bill would impose a state-mandated local program. This bill would authorize the department to enforce its provisions with administrative and civil remedies, as specified. The Corporate Securities Law of 1968 generally regulates the offering and selling in this state of a security, as defined. This bill would define "security" to not include a staking reward, as defined. The California Constitution requires the state to reimburse local agencies and school districts for certain costs mandated by the state. Statutory provisions establish procedures for making that reimbursement. This bill would provide that no reimbursement is required by this act for a specified reason.
Existing law requires every videogame retailer to post a sign, within the retail establishment in a prominent area, providing information to consumers about a videogame rating system or notifying consumers that a rating system is available to aid in the selection of a game and to make available to consumers, upon request, information that explains the videogame rating system. Existing law, subject to certain exceptions, prohibits a seller of a digital good, including a digital application or game, from advertising or offering for sale a digital good to a purchaser with the terms "buy," "purchase," or any other term that a reasonable person would understand to confer an unrestricted ownership interest in the digital good, or alongside an option for a time-limited rental, unless the seller receives at the time of each transaction an affirmative acknowledgment from the purchaser, or the seller provides to the consumer before executing each transaction a clear and conspicuous statement, as specified. Existing law defines "digital application or game" to mean any application or game that a person accesses and manipulates using a specialized electronic gaming device, computer, mobile device, tablet, or other device with a display screen, including any add-ons or additional content for that application or game. This bill, with regard to digital games first available for purchase or rereleased for purchase on or after January 1, 2028, and subject to certain exceptions, would require a digital game operator to communicate specified information to purchasers and prospective purchasers of a digital game 60 days before the operator ceases to provide services necessary for the ordinary use of the game. The bill would, beginning on the date an operator ceases to provide services necessary for the ordinary use of the game, require the operator to provide the purchaser with, among other things, an alternate version of, a patch or update to, or a refund for, the game, as provided, and prohibit the operator from selling, leasing, or otherwise distributing a version of the game that cannot be used by a purchaser independent of services controlled by the operator. The bill would authorize the Attorney General or a district attorney to bring a civil action for a violation of these provisions.
Existing law requires, among other things related to ensuring the safety of companion chatbots, an operator to prevent a companion chatbot on its companion chatbot platform from engaging with users unless the operator maintains a protocol for preventing the production of suicidal ideation, suicide, or self-harm content to the user, as specified. This bill, the Preventing AI User Self Endangerment (PAUSE) Act, would require an operator to adopt and make publicly available a policy governing its protocol for identifying and responding to credible crisis expressions and, for each companion chatbot an operator makes available to users in this state, implement a system for monitoring and detecting credible crisis expressions in user conversations with companion chatbots. The bill would require, if the monitoring system detects a credible crisis expression, the operator to take certain actions, including commence a crisis interruption pause, as specified. The bill would define "credible crisis expression" to mean a statement by a user of a companion chatbot that reasonably indicates, as determined through contextual analysis rather than keyword detection alone, intent to harm the user or others. This bill would require an operator of a companion chatbot to document certain information related to credible crisis expressions and crisis interruption pauses and, beginning January 1, 2028, annually report that information to the Office of Suicide Prevention. The bill would provide for its enforcement, as specified.
Existing law requires a state agency or department that utilizes generative artificial intelligence (GenAI) to directly communicate with a person regarding government services and benefits to ensure that those communications include a disclaimer that indicates to the person that the communication was generated by GenAI, as specified, and information describing how a person may contact a human employee of the state agency or department. This bill would instead require that disclaimer when a state agency or department uses GenAI to directly communicate with the public and would define "directly communicate" to mean to use GenAI, instead of a natural person, to communicate directly with a specific member of the public or to communicate a general public announcement, as specified.
Existing law establishes various privacy protections relating to the collection, use, sale, or distribution of personal information, images, or video recordings, including restrictions relating to the retention, access, use, sale, or sharing of images or video recordings collected through the operation of an in-vehicle camera. This bill would prohibit a security surveillance company, as defined, from distributing, selling, or otherwise authorizing a third party to access, use, or distribute content obtained from a consumer's security surveillance system without first obtaining the express consent of the consumer and the adult residents of a residential rental property or upon receipt of an order of a court or arbitrator.
The Unruh Civil Rights Act requires persons within the jurisdiction of the state to be free and equal and, regardless of the person's sex, race, color, religion, ancestry, national origin, disability, medical condition, genetic information, marital status, sexual orientation, citizenship, primary language, or immigration status, to be entitled to the full and equal accommodations, advantages, facilities, privileges, or services in all business establishments, as prescribed, and makes a violation of the federal Americans with Disabilities Act of 1990 (ADA) a violation of the act. Existing law imposes liability upon a person who denies, aids, or incites a denial of, or makes any discrimination or distinction contrary to, rights afforded by law for actual damages suffered, exemplary damages, a civil penalty, and attorney's fees, as specified, to any person who was denied the specified rights. Existing law also imposes liability upon a person, firm, or corporation that denies or interferes with admittance to, or enjoyment of, public facilities or otherwise interferes with the rights of an individual with a disability, as specified, for damages and attorney's fees to a person who was denied those rights. This bill would grant to an entity an affirmative defense to a claim seeking statutory damages under the provisions described above on the basis of a specific accessibility barrier on the entity's internet website, as defined, if the entity provided evidence to the plaintiff demonstrating within 30 days of receiving a written prelawsuit demand from the plaintiff that either (1) the entity published a digital accessibility report on the accessibility page of its internet website disclosing the specific access barrier and updated that report to reflect remediation of the access barrier or (2) that various things were true regarding the entity's efforts to identify and remediate access barriers on its internet website, including the entity had a reasonable and good faith basis to believe that the internet website was accessible and conformed with the internet website accessibility standard, as specified. This bill would also prohibit a resource service provider from, in exchange for money or any other form of remuneration, negligently, recklessly, or knowingly constructing, licensing, distributing, or maintaining for online use a resource or part of an internet website that causes an entity's internet website to be inaccessible or not conformant with the internet website accessibility standard if the resource or part of the internet website is within the control of the resource service provider to remediate or from making a false representation that a resource or part of an internet website is accessible or conforms to the internet website accessibility standard. The bill would authorize a small business entity, as defined, and certain public attorneys, including the Attorney General, to bring a civil action to enforce that provision, as specified.
Existing law, the Genetic Information Privacy Act, requires a direct-to-consumer genetic testing company, as defined, to provide a consumer with certain information regarding the company's policies and procedures for the collection, use, maintenance, and disclosure, as applicable, of genetic data, and to obtain a consumer's express consent for collection, use, or disclosure of the consumer's genetic data, as specified. Existing law assesses a civil penalty not to exceed $1,000 for a negligent violation of these provisions, and a civil penalty between $1,000 and $10,000, inclusive, for a willful violation of these provisions. This bill would require all local law enforcement agencies in the state to report to the Attorney General starting July 1, 2027, and annually thereafter, the number of reports filed in the past year on the theft of deoxyribonucleic acid (DNA) and the current status of those cases. The bill would require the Attorney General to, on or before January 1, 2028, report to the Legislature, and post on its internet website, the number of police reports filed on the theft of DNA and the current status of those cases. By increasing duties on local law enforcement, this bill would impose a state-mandated local program. The California Constitution requires the state to reimburse local agencies and school districts for certain costs mandated by the state. Statutory provisions establish procedures for making that reimbursement. This bill would provide that, if the Commission on State Mandates determines that the bill contains costs mandated by the state, reimbursement for those costs shall be made pursuant to the statutory provisions noted above.
The California Consumer Privacy Act of 2018 (CCPA) grants a consumer various rights with respect to personal information, as defined, that is collected or sold by a business, as defined, including the right to request that a business that collects personal information about the consumer disclose to the consumer certain information about that personal information, including the categories of personal information it has collected about that consumer and the specific pieces of personal information it has collected about that consumer. This bill, the Digital Choice Act, would require a social media company or a person that makes an artificial intelligence model available to a third party for use, modification, copying, or combination with other software, defined as a deployer, to allow a consumer to request a copy of the consumer's personal information, contextual data, and social graph and would require the social media company or deployer to respond to that request within five business days in a format that is, among other things, portable to the extent technically feasible. The bill would define "contextual data" to mean information provided by a user to an artificial intelligence model and any context or derivative data associated with the user's interactions with the artificial intelligence model, as specified, and any model-generated or inferred data linked to or generated from those interactions. The bill would define "social graph" to mean data that represents a person's connections and interactions within a social media platform, as specified. This bill would require, among other things, a social media company to implement a transparent, third-party-accessible interoperability interface that allows a user to choose to share a covered user's social graph or user-selected parts of the social graph to a social media platform designated by the user and enable a third party to, with the user's permission, access a social graph created by the user and be notified when a new or updated social graph is available, as prescribed. The bill would require a deployer to implement a third-party-accessible interoperability interface to allow a user to share the user's contextual data directly with other artificial intelligence models as the user designates and enable those artificial intelligence models to be notified when new or updated data is available, as prescribed. This bill would authorize the Attorney General to adopt specified regulations, as provided, and require the Attorney General to enforce the bill's provisions by bringing an administrative action, as specified.
Existing law establishes the Division of Labor Standards Enforcement within the Department of Industrial Relations to administer and enforce various laws relating to employment and working conditions. This bill would require an employer to provide a written notice to a worker that a workplace AI tool, as defined, was used to assist the employer in making employment-related decisions or to surveil workers in the workplace. The bill would require the notice to be given to a worker within a specified time and would require the notice to contain specified information, including the specific employment-related decisions likely to be affected by the use of the workplace AI tool. The bill would require an employer to maintain an updated list of all workplace AI tools currently in use and their impact on jobs, as specified, and to provide the list to workers annually. The bill would provide for enforcement by the Labor Commissioner or a public prosecutor, and alternatively would authorize any worker who has suffered damages, or their exclusive representative, to file a civil action for damages caused by the adverse action. The bill would establish remedies and penalties for violations, including a penalty of up to $500 for each violation. The bill would include findings that changes proposed by this bill address a matter of statewide concern rather than a municipal affair and, therefore, apply to all cities, including charter cities.
