The California Consumer Privacy Act of 2018 (CCPA) grants a consumer various rights with respect to personal information, as defined, that is collected or sold by a business, as defined, including the right to request that a business that collects personal information about the consumer disclose to the consumer certain information about that personal information, including the categories of personal information it has collected about that consumer and the specific pieces of personal information it has collected about that consumer. This bill, the Digital Choice Act, would require a social media company or a person that makes an artificial intelligence model available to a third party for use, modification, copying, or combination with other software, defined as a deployer, to allow a consumer to request a copy of the consumer's personal information, contextual data, and social graph and would require the social media company or deployer to respond to that request within five business days in a format that is, among other things, portable to the extent technically feasible. The bill would define "contextual data" to mean information provided by a user to an artificial intelligence model and any context or derivative data associated with the user's interactions with the artificial intelligence model, as specified, and any model-generated or inferred data linked to or generated from those interactions. The bill would define "social graph" to mean data that represents a person's connections and interactions within a social media platform, as specified. This bill would require, among other things, a social media company to implement a transparent, third-party-accessible interoperability interface that allows a user to choose to share a covered user's social graph or user-selected parts of the social graph to a social media platform designated by the user and enable a third party to, with the user's permission, access a social graph created by the user and be notified when a new or updated social graph is available, as prescribed. The bill would require a deployer to implement a third-party-accessible interoperability interface to allow a user to share the user's contextual data directly with other artificial intelligence models as the user designates and enable those artificial intelligence models to be notified when new or updated data is available, as prescribed. This bill would authorize the Attorney General to adopt specified regulations, as provided, and require the Attorney General to enforce the bill's provisions by bringing an administrative action, as specified.
Existing law establishes the Division of Labor Standards Enforcement within the Department of Industrial Relations to administer and enforce various laws relating to employment and working conditions. This bill would require an employer to provide a written notice to a worker that a workplace AI tool, as defined, was used to assist the employer in making employment-related decisions or to surveil workers in the workplace. The bill would require the notice to be given to a worker within a specified time and would require the notice to contain specified information, including the specific employment-related decisions likely to be affected by the use of the workplace AI tool. The bill would require an employer to maintain an updated list of all workplace AI tools currently in use and their impact on jobs, as specified, and to provide the list to workers annually. The bill would provide for enforcement by the Labor Commissioner or a public prosecutor, and alternatively would authorize any worker who has suffered damages, or their exclusive representative, to file a civil action for damages caused by the adverse action. The bill would establish remedies and penalties for violations, including a penalty of up to $500 for each violation. The bill would include findings that changes proposed by this bill address a matter of statewide concern rather than a municipal affair and, therefore, apply to all cities, including charter cities.
Existing law establishes the Division of Labor Standards Enforcement within the Department of Industrial Relations. Existing law authorizes the division, which is headed by the Labor Commissioner, to enforce the Labor Code and all labor laws of the state, the enforcement of which is not specifically vested in any other officer, board, or commission. This bill would prohibit an employer from using a worker's personal information, as defined, to train an artificial intelligence system to replicate, automate, or replace a worker's job, and would prohibit an employer from selling, disclosing, or otherwise providing access to a worker's personal information to a third party for the purpose of training an artificial intelligence system to replicate, automate, or replace a worker's job. The bill would prohibit a vendor providing services to an employer under a contract from providing access to the personal information of an employer's worker to a third party or using the personal information of an employer's worker to train artificial intelligence, as specified. The bill would require a contract between an employer and vendor to include a requirement that the vendor implement and maintain reasonable security procedures to protect the worker's personal information from, among other things, unauthorized or illegal access. The bill would define terms for these provisions, including "employer" and "personal information." The bill would require the Labor Commissioner and authorize a public prosecutor to enforce these provisions. The bill would authorize a worker, or their exclusive representative, who suffered a violation of these provisions to bring a civil action for damages, injunctive relief, punitive damages, and attorney's fees and costs. The bill would establish a statutory penalty for a violation of these provisions of up to $500 for each violation. The bill would include findings that changes proposed by this bill address a matter of statewide concern rather than a municipal affair and, therefore, apply to all cities, including charter cities.
Existing law prohibits a public agency, which includes the state, a city, a county, a city and county, or any agency or political subdivision of the state, a city, a county, or a city and county, including, but not limited to, a law enforcement agency, from selling, sharing, or transferring automated license plate recognition (ALPR) information, except to another public agency, and only as otherwise permitted by law. Existing law defines ALPR information as information or data collected through the use of an ALPR system. This bill would provide that "public agency" does not include a transportation agency, a public transit operator, or a local department of transportation or public works department, as specified. The bill would, beginning January 1, 2026, require new, updated, expansions of, or addendums of contractual agreements with ALPR vendors, manufacturers, or suppliers to mandate that no default access is provided to any national ALPR database and that an agency's collected scans are by default not accessible to any other agency, and would impose new requirements on sharing between California state law enforcement agencies. The bill would authorize a law enforcement agency to use ALPR information only for purposes of locating vehicles or persons when either are reasonably suspected of being involved in the commission of a public offense. The bill would prohibit a public agency from retaining ALPR information for more than 60 days after the date of collection if it does not match information on an authorized hot list, as defined, and as of January 1, 2026, would require a public agency to delete all ALPR information that has been held for more than 60 days and does not match information on an authorized hot list within 14 days. By imposing new requirements on public agencies, which include local agencies, this bill would impose a state-mandated local program. Existing law defines an ALPR operator as a person that operates an ALPR system, which does not include a transportation agency. Existing law defines an ALPR end-user a person that accesses or uses an ALPR system, which does not include, among other things, a transportation agency. This bill would additionally exclude from the definitions of "ALPR operator" and "ALPR end-user" a public transit operator, a local department of transportation or public works department, or an airport or airport operator, as provided. Existing law requires an ALPR operator and ALPR end-user to maintain reasonable security procedures and practices, including operational, administrative, technical, and physical safeguards, to protect ALPR information from unauthorized access, destruction, use, modification, or disclosure. This bill would require those security procedures and practices to include safeguards for managing which employees can see the data from their systems, as specified, and requiring data security training and data privacy training for all employees that access ALPR information. Existing law requires an ALPR operator and ALPR end-user to implement a usage and privacy policy that includes, among other things, a description of the job title or other designation of the employees and independent contractors who are authorized to access and use ALPR information. This bill would require the usage and privacy policy to identify what purpose employees and independent contractors access and use ALPR information for. The bill would also require the Department of Justice to, contingent upon an appropriation of sufficient funds, conduct annual random audits on a public agency that is an ALPR operator or ALPR end-user to determine whether they have implemented and are adhering to that usage and privacy policy. Existing law requires an ALPR operator that accesses or provides access to ALPR information to require that ALPR information only be used for the authorized purposes described in the usage and privacy policy and to maintain a record of that access that includes, among other things, the purpose for accessing the information. This bill would instead require that record of access maintained by the ALPR operator to include the case file number or task force name, as applicable, that justifies the search query, and would provide that no queries shall be allowed without a log entry with a valid and current case file number or task force name from the agency conducting the query. The bill would include findings that changes proposed by this bill address a matter of statewide concern rather than a municipal affair and, therefore, apply to all cities, including charter cities. The California Constitution requires the state to reimburse local agencies and school districts for certain costs mandated by the state. Statutory provisions establish procedures for making that reimbursement. This bill would provide that, if the Commission on State Mandates determines that the bill contains costs mandated by the state, reimbursement for those costs shall be made pursuant to the statutory provisions noted above.
Existing law establishes the State Air Resources Board as the state agency responsible for monitoring and regulating sources emitting greenhouse gases. Existing law requires the state board to establish a Carbon Capture, Removal, Utilization, and Storage Program, as provided, to evaluate the efficacy, safety, and viability of carbon capture, utilization, or storage technologies and carbon dioxide removal technologies and facilitate the capture and sequestration of carbon dioxide from those technologies, where appropriate. Existing law requires the Secretary of the Natural Resources Agency, in consultation with the state board, to publish a framework for governing agreements regarding 2 or more tracts of land overlying the same geologic storage reservoir or reservoirs for purposes of managing, developing, and operating a carbon dioxide capture, removal, or sequestration project, as provided. This bill would require the state board to establish and administer the Carbon Dioxide Removal Purchase Program as a competitive grant process for eligible carbon dioxide removal projects, as specified. The bill would require the state board, on or before January 1, 2028, and annually thereafter, to conduct and publish on its internet website a survey of carbon dioxide removal projects existing or in development within the state, and, on or before December 31, 2027, and annually thereafter, until December 31, 2035, to publish on its internet website a report describing Carbon Dioxide Removal Purchase Program activities completed and carbon dioxide removal projects to date, as specified. The bill would require the state board, on or after July 1, 2026, but on or before December 31, 2035, to fund carbon dioxide removal projects in an amount totaling $50,000,000. The bill would authorize up to 10% of that amount to be used to supplement necessary administrative costs in establishing the program. The bill would prohibit carbon dioxide removal projects from exceeding $25,000,000 of grants toward qualified carbon dioxide removals in any one of specified project categories or $12,500,000 of grants towards any one individual carbon dioxide removal project sponsor, except as specified. The bill would require that eligible carbon dioxide removal projects permanently retire the contracted tons of removed carbon dioxide from any future carbon dioxide removals credit issuance. The bill would require the state board, on or before January 1, 2028, to adopt guidelines, including the definition of an eligible carbon dioxide removal project, for the program, which the bill would require to be consistent with certain provisions governing carbon dioxide capture, removal, or sequestration projects, as specified. The bill would make implementation of these provisions contingent upon an appropriation by the Legislature for purposes of the program. The bill would require all funds to be available for encumbrance or expenditure until June 30, 2035, and to be available for liquidation until June 30, 2035.
Existing law requires the Department of Technology to conduct, in coordination with other interagency bodies as it deems appropriate, a comprehensive inventory of all high-risk automated decision systems (ADS) that have been proposed for use, development, or procurement by, or are being used, developed, or procured by, any state agency. Existing law establishes the Labor and Workforce Development Agency, which is composed of various departments responsible for protecting and promoting the rights and interests of workers in California, including the Division of Labor Standards Enforcement, led by the Labor Commissioner, within the Department of Industrial Relations. This bill would require an employer to provide a written notice that an ADS, for the purpose of making employment-related decisions, not including hiring, is in use at the workplace to all workers that will foreseeably be directly affected by the ADS, as specified. The bill would require the employer to maintain an updated list of all ADS currently in use. The bill would require an employer to notify, as provided, a job applicant that the employer utilizes an ADS when making hiring decisions, if the employer will use the ADS in making decisions for that position. The bill would prohibit an employer from using an ADS that does certain functions and would limit the purposes and manner in which an ADS may be used to make decisions. The bill would authorize a worker to request, and require an employer to provide, a copy of the most recent 12 months of the worker's own data primarily used by an ADS to make a discipline, termination, or deactivation decision, as specified. The bill would require an employer that primarily relied on an ADS to make a discipline, termination, or deactivation decision to provide the affected worker with a written notice, as specified. This bill would prohibit an employer from discharging, threatening to discharge, demoting, suspending, or in any manner discriminating or retaliating against any worker for taking certain actions asserting their rights under the bill. The bill would require the Labor Commissioner to enforce the bill's provisions, as specified, and would authorize a public prosecutor to bring a civil action. The bill would set forth specified types of relief that a plaintiff may seek and specified penalties that an employer that violates these provisions is subject to, including a $500 civil penalty. The bill would also provide that an employer who complies with the requirements related to notice in this bill is not required to comply with any substantially similar provisions under any other state law, except as specified. The bill would not apply to parties covered by a valid collective bargaining agreement if the agreement contains specified information, including an explicit waiver of the bill's provisions. The bill would declare that its provisions do not prohibit any employer from complying with regulatory or contractual requirements in the provision of products or services to the federal government, as defined. This bill would declare that its provisions are severable.
Existing law generally regulates social media platforms, including by requiring a social media company to post terms of service for each social media platform owned or operated by the company in a manner reasonably designed to inform all users of the social media platform of the existence and contents of the terms of service, as prescribed. Existing law generally prohibits a person from using violence or intimidation to interfere with another person's enjoyment of certain rights or because of certain attributes of that person, including the person's political affiliation, race, or sexual orientation, and punishes violations of that law with certain civil penalties or as misdemeanors, as prescribed. This bill would make a social media platform, as defined, that violates the above-referenced provisions of law relating to personal rights through its algorithms that relay content to users or aids, abets, acts in concert, or conspires in violation of those laws, or is a joint tortfeasor in an action alleging a violation of those laws, liable for specified civil penalties. The bill would declare its provisions to be severable and would declare attempted waiver of its provisions to be void and unenforceable. This bill would become operative on January 1, 2027.
Existing law establishes the Division of Labor Standards Enforcement within the Department of Industrial Relations. Existing law authorizes the division, which is headed by the Labor Commissioner, to enforce the Labor Code and all labor laws of the state, the enforcement of which is not specifically vested in any other officer, board, or commission. This bill would generally regulate the use of workplace surveillance tools and an employer's use of worker data. The bill would, among other things, require an employer, at least 30 days before introducing a workplace surveillance tool, to provide a worker who will be affected a written notice that includes, among other things, a description of the worker data to be collected, the intended purpose of the workplace surveillance tool, and how this form of worker surveillance is necessary to meet that purpose. The bill would define "employer" to include public employers, as specified. The bill would prohibit an employer from transferring, selling, disclosing, or licensing worker data to a vendor, unless the vendor is under contract to analyze or interpret the worker data and the contract includes certain terms. The bill would prohibit an employer from using certain workplace surveillance tools, including a workplace surveillance tool that incorporates facial, gait, or emotion recognition technology, except as specified. The bill would also prohibit an employer from using a workplace surveillance tool to infer specified categories of information about a worker, including, among others, their immigration status, veteran status, ancestral history, religious or political beliefs, disability status, criminal record, or credit history. The bill would require the Labor Commissioner to enforce the bill's provisions, would authorize an employee to bring a civil action for specified remedies for a violation of the bill's provisions, and would authorize a public prosecutor to enforce the provisions. The bill would subject an employer who violates the bill's provisions to a civil penalty of $500 for each violation. The bill would define various terms for purposes of its provisions.
(1) Existing law, the California Consumer Privacy Act of 2018 (CCPA) , grants a consumer various rights with respect to personal information, as defined, that is collected or sold by a business, as defined, including the right to direct a business that collects sensitive personal information about the consumer to limit its use, as prescribed. Existing law defines "sensitive personal information" to mean, among other things, personal information that reveals a consumer's precise geolocation. Existing law, the California Privacy Rights Act of 2020, approved by the voters as Proposition 24 at the November 3, 2020, statewide general election, amended, added to, and reenacted the CCPA. This bill would prohibit a covered entity from collecting or processing the location information of an individual unless doing so is necessary to provide goods or services requested by that individual. The bill would impose various other restrictions on covered entities with regard to location information. The bill would define various terms for purposes of these provisions, including "location information" to mean information that pertains to or directly or indirectly reveals the present or past geographical location of an individual or device, as specified. This bill would require a covered entity to prominently display, at the point where location information is being captured, a notice to individuals stating that their location information is being collected, the name of the covered entity and service provider collecting the information, and a phone number and an internet website where the individual can obtain more information. The bill would require a covered entity to maintain and make available to the data subject a location privacy policy that includes specified information on data usage and management and is subject to a specified notice procedure. This bill would make a covered entity that violates these provisions liable for actual or statutory damages and other specified relief. The bill would authorize the Attorney General or other public prosecutors to bring an action to recover a civil penalty against a covered entity that violates these provisions. This bill would require a business, as defined by the CCPA, to comply with the above-described provisions. (2) Existing law, the Information Practices Act of 1977, prescribes a set of requirements, prohibitions, and remedies applicable to agencies, as defined, with regard to their collection, storage, and disclosure of personal information, as defined. This bill would prohibit a state or local agency, including an agency as defined under the Information Practices Act, from monetizing, as defined, location information. By imposing new requirements on local agencies, this bill would impose a state-mandated local program. (3) The California Constitution requires the state to reimburse local agencies and school districts for certain costs mandated by the state. Statutory provisions establish procedures for making that reimbursement. This bill would provide that, if the Commission on State Mandates determines that the bill contains costs mandated by the state, reimbursement for those costs shall be made pursuant to the statutory provisions noted above. (4) The California Consumer Privacy Act of 2020 authorizes the Legislature to amend the act to further the purposes and intent of the act by a majority vote of both houses of the Legislature, as specified. This bill would declare that its provisions further the purposes and intent of the California Privacy Rights Act of 2020.
The California AI Transparency Act requires a person that creates, codes, or otherwise produces a generative artificial intelligence system that has over 1,000,000 monthly visitors or users and is publicly accessible within the geographic boundaries of the state to make available an AI detection tool at no cost to the user that, among other things, allows a user to assess whether image, video, or audio content, or content that is any combination thereof, was created or altered by the covered provider's generative artificial intelligence system. The California Consumer Privacy Act of 2018 prohibits certain businesses from selling or sharing the personal information of consumers if the business has actual knowledge that the consumer is less than 16 years of age, unless the consumer, if the consumer is at least 13 years of age and less than 16 years of age, or the consumer's parent or guardian, if the consumer is less than 13 years of age, has affirmatively authorized the sale or sharing of the consumer's personal information. This bill, the Leading Ethical AI Development (LEAD) for Kids Act, would, among other things related to the use of certain artificial intelligence systems by children, prohibit a person, partnership, corporation, business entity, or state or local government agency that makes a companion chatbot available to users from making a companion chatbot available to a child unless the companion chatbot is not foreseeably capable of doing certain things that could harm a child, including encouraging the child to engage in self-harm, suicidal ideation, violence, consumption of drugs or alcohol, or disordered eating. The act would authorize the Attorney General to recover a certain civil penalty for a violation of the bill, as prescribed. The act would authorize a child who suffers actual harm as a result of a violation of the bill, or a parent or guardian acting on behalf of that child, to bring a civil action to recover, among other relief, actual damages. This bill would provide that its provisions are severable.
