Existing law generally regulates artificial intelligence, including companion chatbots, as defined. Existing law requires an operator, as defined, to prevent a companion chatbot on its companion chatbot platform from engaging with users unless the operator maintains a protocol for preventing the production of suicidal ideation, suicide, or self-harm content to the user. Existing law requires an operator, for a user the operator knows is a minor, to, among other things, notify the user that the user is interacting with artificial intelligence and to disclose that companion chatbots may not be suitable for some minors, as specified. The Digital Age Assurance Act requires a person who owns, maintains, or controls a software application, as defined, to request age bracket data sent by a real-time secure application programming interface or operating system with respect to a particular user from an operating system provider or a covered application store when the application is downloaded and launched. This bill would require an operator, as defined, of a companion chatbot to, on or before July 1, 2027, do various things with respect to child safety and companion chatbots, including annually perform and document a comprehensive risk assessment to identify any child safety risk, as defined, posed by the design, configuration, and operation of the companion chatbot that assesses, among other things, the likelihood of a covered harm, as defined, occurring to child users. The bill would require an operator to submit to an independent audit of its compliance with those provisions, as specified, and would require, within 90 days of completing an independent audit, the auditor to submit an AI child safety audit report to the Attorney General for any audited companion chatbot. The bill would, except as specified, require those audit reports to be kept confidential. This bill would, beginning January 1, 2028, require the Attorney General to issue an annual public report on the audits submitted pursuant to the above-described provision, as specified. The bill would authorize a public prosecutor to bring a certain civil action to enforce the bill's provisions and would authorize a child who suffers actual harm as a result of a violation of this chapter, or a parent or guardian acting on behalf of that child, to bring a civil action against the operator to obtain, among other relief, punitive damages. Existing constitutional provisions require that a statute that limits the right of access to the meetings of public bodies or the writings of public officials and agencies be adopted with findings demonstrating the interest protected by the limitation and the need for protecting that interest. This bill would make legislative findings to that effect.
Existing law charges the Labor Commissioner with enforcement of various labor laws, including investigation of employee complaints. This bill would declare it is the policy of the state that a worker providing direct patient care be free to use their professional judgment to make assessments and decisions within their scope of practice as appropriate for their patients. The bill would prohibit an employer from retaliating or discriminating against a worker providing patient care, as specified. The bill would authorize a worker who is subject to retaliation or discrimination in violation of these provisions to file a complaint with the Labor Commissioner against an employer. The bill would require the Labor Commissioner to enforce these provisions, as specified. Existing law provides that everyone is responsible not only for the result of their willful acts, but also for an injury occasioned to another by their want of ordinary care or skill in the management of their property or person. Existing law prohibits a defendant who developed, modified, or used artificial intelligence, as defined, from asserting a defense that the artificial intelligence autonomously caused the harm to the plaintiff. This bill would prohibit a defendant who developed, modified, selected, or deployed a clinical decision support system that is alleged to have harmed the plaintiff from asserting a defense that the failure of a licensed health care professional or other health care worker to override an output of the clinical decision support system is a superseding cause severing the defendant's liability for the alleged harm.
Existing law establishes the Office of Elections Cybersecurity within the Secretary of State's office to coordinate efforts between the Secretary of State and local elections officials to reduce the likelihood and severity of cyber incidents and to monitor and counteract false or misleading information regarding the electoral process. Existing law requires the Office of Elections Cybersecurity, among other things, to develop best practices for protecting against threats to election cybersecurity in consultation with federal, state, and local agencies and private organizations. This bill would also authorize the office to consult with academic researchers for that purpose. The bill would require the office to assess whether additional state resources are needed to replace election cybersecurity resources previously provided by the federal government.
Existing law requires the operator of a private detention facility, as defined, to comply with, and adhere to, the detention standards of care and confinement agreed upon in the facility's contract for operations, as specified. Existing law requires a private detention facility operator to comply with, and adhere to, all local and state public health orders and occupational safety and health regulations. This bill, the Protecting Vulnerable Immigrant Detainees Model Act, would require the Attorney General, on or before December 31, 2027, to submit to the Legislature a report including a proposed oversight plan for private civil detention facilities that protects the health, safety, and welfare of persons detained in those facilities, as specified. The bill would require the Governor to direct the appropriate state entity to cooperate with the Attorney General for the purposes of developing the oversight plan, as specified. The bill would make related findings and declarations. Existing constitutional provisions require that a statute that limits the right of access to the meetings of public bodies or the writings of public officials and agencies be adopted with findings demonstrating the interest protected by the limitation and the need for protecting that interest. This bill would make legislative findings to that effect.
Existing law requires the Department of Technology to conduct, in coordination with other interagency bodies as it deems appropriate, a comprehensive inventory of all high-risk automated decision systems (ADS) that have been proposed for use, development, or procurement by, or are being used, developed, or procured by, any state agency. Existing law establishes the Labor and Workforce Development Agency, which is composed of various departments responsible for protecting and promoting the rights and interests of workers in California, including the Division of Labor Standards Enforcement, led by the Labor Commissioner, within the Department of Industrial Relations. This bill, beginning on July 1, 2027, would prohibit an employer, as defined, from using an ADS to perform certain functions and would limit the purposes for and way in which an ADS may be used. The bill would, when an employer primarily uses an ADS to make a disciplinary or termination decision, authorize an employee to request, and require an employer to provide, a description of the employee's own data primarily used by an ADS to make a disciplinary or termination decision, as specified. The bill would require an employer that primarily relied upon an ADS to make a disciplinary or termination decision to provide the affected employee with a written postuse notice, as specified. This bill would prohibit an employer from discharging, threatening to discharge, demoting, suspending, or in any manner discriminating or retaliating against any employee for taking certain actions asserting their rights under the bill. The bill would authorize the Labor Commissioner to enforce the bill's provisions and also authorize a public prosecutor to bring a civil enforcement action, as specified. The bill would set forth specified types of relief that a plaintiff may seek and specified penalties that an employer that violates these provisions is subject to, including a $500 civil penalty per violation. This bill would also provide that an employer who complies with the requirements related to notice in this bill is not required to comply with any substantially similar provisions under any other state law, except as specified. The bill would not apply to parties covered by a valid collective bargaining agreement if the agreement contains specified information, including an explicit waiver of the bill's provisions. The bill would provide that it does not prohibit the use of an automated decision system relating to the development of aircraft for use in the national airspace or the development of products or services for national security, military, space, or defense purposes, if the use of an automated decision system is reasonably necessary to comply with the federal statute, the federal regulation, or the binding federal contract, as specified. The bill would include a statement that changes proposed by this bill address a matter of statewide concern rather than a municipal affair and, therefore, apply to all cities, including charter cities. This bill would declare that its provisions are severable.
Existing law prohibits the intentional use of an electronic amplifying or recording device to eavesdrop upon or record a confidential communication, as specified, without the consent of all parties to the communication. Existing law additionally prohibits tapping a communication wire or intercepting or recording a telephone communication, as specified, without the consent of all parties, and prohibits trespassing on property for the purpose of committing, or attempting to commit, a violation of those prohibitions. A violation of those provisions is punishable by a fine not exceeding $2,500, by imprisonment as either a misdemeanor or a felony, or by both the fine and imprisonment, unless otherwise exempted. If that person has previously been convicted of a violation of any of the above-described laws, except for the prohibition on trespassing, a violation of any of those provisions is punishable by a fine not exceeding $10,000, by imprisonment as either a misdemeanor or a felony, or by both the fine and imprisonment. This bill would additionally prohibit a person from operating a wearable recording device, as defined, to capture sound or video of any other person in any area within a place of business, as defined, where the person has a reasonable expectation of privacy unless the person operating the device has the explicit consent of that person to capture sound or video of that person. The bill would prohibit a person from disabling any light, sound, or other indicator on a wearable recording device that indicates that the device is capturing sound or video. The bill would exempt from these provisions the use of hearing aids, augmentative and alternative communication devices, and similar devices by persons with impaired hearing or communication disorders when used for the purpose of overcoming the impairment or disorder to permit the hearing of sounds ordinarily audible to the human ear or to support communication with the person or by persons with a disability if the device or technology is used for the purpose of enabling a person's access to, or participation in, activities of daily living or to support a person's functional needs related to the disability or condition. The bill would make a violation of these provisions punishable by a fine not exceeding $1,500, by imprisonment as a misdemeanor, or by both that fine and imprisonment. The bill would make the exemptions from the provisions described above applicable to violations of these prohibitions. By creating new crimes, the bill would impose a state-mandated local program. The bill would, commencing on January 1, 2028, prohibit a person or entity from manufacturing, selling, delivering, holding, or offering for sale in commerce a wearable recording device without a light, sound, or other indicator that is sufficiently prominent so that a reasonable person in the vicinity would be alerted to the capturing activity. The bill would prohibit a person or entity from manufacturing, selling, delivering, holding, or offering for sale in commerce any technology that is designed for the primary purpose of, primarily marketed for, or likely primarily used for enabling a person to disable any light, sound, or other indicator on a wearable recording device that indicates that the device is capturing sound or video and would prohibit a person from purchasing, trading for, otherwise acquiring, or using that technology, as specified. The bill would make a knowing violation of these provisions punishable by a civil penalty not exceeding $2,500 per violation. The California Constitution requires the state to reimburse local agencies and school districts for certain costs mandated by the state. Statutory provisions establish procedures for making that reimbursement. This bill would provide that no reimbursement is required by this act for a specified reason.
The California Consumer Privacy Act of 2018 (CCPA) grants a consumer various rights with respect to personal information, as defined, that is collected or sold by a business, as defined, including the right to direct a business that collects sensitive personal information, as defined, about the consumer to limit its use, as prescribed. The California Privacy Rights Act of 2020, approved by the voters as Proposition 24 at the November 3, 2020, statewide general election, amended, added to, and reenacted the CCPA. This bill would, under the CCPA, prohibit a business, service provider, or contractor from selling or sharing sensitive personal information to a third party, except as specified. This bill would declare that its provisions further the purposes and intent of the California Privacy Rights Act of 2020.
Existing law prohibits a person from using a bot, as defined, to mislead another person about the bot's artificial identity to incentivize the purchase or sale of goods or services, among other things. Existing law requires an operator of a companion chatbot, as defined, to provide a disclosure regarding the companion chatbot's artificial identity if a reasonable person interacting with the companion chatbot would be misled to believe that the person is interacting with a human. This bill would prohibit a large private business, as defined, from representing that a customer service chatbot is a human. The bill would also require the large private business to provide certain disclosures if a reasonable person interacting with the chatbot would be misled to believe they are interacting with a human. This bill would require a large private business to provide a customer service feature allowing customers to contact a customer service agent during its regular business hours, as defined. This bill would require, except as specified, large private businesses to make a good faith effort to connect a customer to an agent within 15 minutes after a request for human customer service is made, or schedule an appointment with the customer, as specified. For online chatbot customer service platforms and telephonic customer service platforms, the bill would require a large private business to make a good faith effort to limit initial and cumulative telephonic hold times, and would require certain large private businesses to post prescribed contact information on their internet website. The bill would authorize a public prosecutor to enforce these provisions, and would make a large private business that violates these provisions liable for a penalty of up to $5,000 for an initial violation, and $10,000 for each subsequent violation. The bill would waive its requirements due to unforeseen circumstances beyond the reasonable control of a large private business or extraordinary or emergency situations, and would exempt a large private business that provides services subject to, and is in compliance with, specified public utilities law. The bill would further exempt exclusive business lines and communications by a hospital, as specified, and a consumer reporting agency, as prescribed. The bill would define terms for these purposes.
Existing law, the K–12 Pupil Online Personal Information Protection Act (KOPIPA) , generally protects the personal information of a student enrolled in a K–12 course of instruction, defined as a "pupil," by prescribing requirements and prohibitions applicable to an operator of an internet website, online service, online application, or mobile application with actual knowledge that the site, service, or application is used primarily for K–12 school purposes and was designed and marketed for K–12 school purposes. Existing law, the Early Learning Personal Information Protection Act (ELPIPA) , generally protects the personal information of a child enrolled in a preschool or prekindergarten course of instruction, defined as a "pupil," by prescribing requirements and prohibitions applicable to an operator of an internet website, online service, online application, or mobile application with actual knowledge that the site, service, or application is used primarily for preschool or prekindergarten purposes and was designed and marketed for preschool and prekindergarten purposes. This bill would instead apply the provisions of KOPIPA and ELPIPA to an operator, or an entity working on behalf of the operator, of an internet website, online service, online application, or mobile application with actual knowledge that the site, service, or application is used for the applicable school purposes and was designed or marketed for those purposes, as specified. The bill would, among other changes to KOPIPA and ELPIPA related to protecting the personal information of students, prohibit an operator from using covered information, as defined, including persistent unique identifiers, created or gathered by the operator's site, service, or application to train a generative artificial intelligence system or service or develop an artificial intelligence system. This bill would also enact the Higher Education Student Information Protection Act (HESIPA) , which would generally protect the personal information of a student enrolled in a higher education institution, as defined, in a similar manner as KOPIPA and ELPIPA. The bill would make HESIPA operative on July 1, 2027. This bill would authorize a pupil or student actually harmed by noncompliance with KOPIPA, ELPIPA, or HESIPA to bring a civil action against the noncompliant operator, as prescribed, and would require a person bringing that action to furnish a copy of the complaint to the Attorney General within 10 days after filing the action.
Existing law requires, on or before September 1, 2024, the Department of Technology, within the Government Operations Agency, to conduct, in coordination with other interagency bodies as it deems appropriate, a comprehensive inventory of all high-risk automated decision systems that have been proposed for use, development, or procurement by, or are being used, developed, or procured by, any state agency. Existing law requires the department to annually submit a report of that comprehensive inventory to the Assembly Committee on Privacy and Consumer Protection and the Senate Committee on Governmental Organization. Existing law, the Transparency in Frontier Artificial Intelligence Act, among other things related to ensuring the safety of certain artificial intelligence models, requires a large frontier developer to write, implement, and clearly and conspicuously publish on its internet website a frontier AI framework that applies to the large frontier developer's frontier models and describes how the large frontier developer approaches, among other things, incorporating national standards, international standards, and industry-consensus best practices into its frontier AI framework. This bill would require, on or before January 1, 2028, the Government Operations Agency to take certain actions related to the selection and regulation of certain entities, defined as "independent verification organizations," designated by the agency as having demonstrated expertise in assessing the risks posed by an AI system or model and identifying the metrics and methodologies that form the basis for that assessment. The bill would require the agency to convene working groups to solicit stakeholder input in the identification of standards and the development and revision of procedures and criteria, as specified. The bill would require the agency to provide a report to the Legislature on the findings of the working groups and would require a designated IVO to submit annually, and no sooner than 12 months after initial designation as an IVO, to the agency and Legislature a report, as specified.
