The Confidentiality of Medical Information Act governs the disclosure of medical information by an employer, a provider of health care, a health care service plan, or a contractor, as those terms are defined. The California Consumer Privacy Act of 2018 (CCPA) authorizes a consumer to direct a business, as defined, that collects sensitive personal information about the consumer to limit its use of the consumer's sensitive personal information, as specified, and defines "sensitive personal information" to include personal information that reveals a consumer's neural data. The CCPA also authorizes a consumer to request that a business delete any personal information about the consumer which the business has collected from the consumer, as prescribed. The California Privacy Rights Act of 2020, approved by the voters as Proposition 24 at the November 3, 2020, statewide general election, amended, added to, and reenacted the CCPA and establishes the California Privacy Protection Agency and vests the agency with full administrative power, authority, and jurisdiction to enforce the CCPA. This bill would require, under the CCPA, a covered business to use neural data only for the purpose for which the neural data was collected and would require a covered business to delete neural data when the purpose for which the neural data was collected is accomplished. The bill would define "covered business" to mean a person who makes available a brain-computer interface to a person in this state and would define "brain-computer interface" to mean a system that allows direct communication and control between a person's brain and an external device. This bill would declare that its provisions further the purposes and intent of the California Privacy Rights Act of 2020.
The California AI Transparency Act requires a person that creates, codes, or otherwise produces a generative artificial intelligence system that has over 1,000,000 monthly visitors or users and is publicly accessible within the geographic boundaries of the state to make available an AI detection tool at no cost to the user that, among other things, allows a user to assess whether image, video, or audio content, or content that is any combination thereof, was created or altered by the covered provider's generative artificial intelligence system. The California Consumer Privacy Act of 2018 prohibits certain businesses from selling or sharing the personal information of consumers if the business has actual knowledge that the consumer is less than 16 years of age, unless the consumer, if the consumer is at least 13 years of age and less than 16 years of age, or the consumer's parent or guardian, if the consumer is less than 13 years of age, has affirmatively authorized the sale or sharing of the consumer's personal information. This bill, the Leading Ethical AI Development (LEAD) for Kids Act, would, among other things related to the use of certain artificial intelligence systems by children, prohibit a person, partnership, corporation, business entity, or state or local government agency that makes a companion chatbot available to users from making a companion chatbot available to a child unless the companion chatbot is not foreseeably capable of doing certain things that could harm a child, including encouraging the child to engage in self-harm, suicidal ideation, violence, consumption of drugs or alcohol, or disordered eating. The act would authorize the Attorney General to recover a certain civil penalty for a violation of the bill, as prescribed. The act would authorize a child who suffers actual harm as a result of a violation of the bill, or a parent or guardian acting on behalf of that child, to bring a civil action to recover, among other relief, actual damages. This bill would provide that its provisions are severable.
Existing law generally provides protections for minors on the internet, including the California Age-Appropriate Design Code Act that, among other things, requires a business that provides an online service, product, or feature likely to be accessed by children to do certain things, including estimate the age of child users with a reasonable level of certainty appropriate to the risks that arise from the data management practices of the business or apply the privacy and data protections afforded to children to all consumers and prohibits an online service, product, or feature from, among other things, using dark patterns to lead or encourage children to provide personal information beyond what is reasonably expected to provide that online service, product, or feature or to forego privacy protections. This bill, beginning January 1, 2027, would require, among other things related to age verification with respect to software applications, an operating system provider, as defined, to provide an accessible interface at account setup that requires an account holder, as defined, to indicate the birth date, age, or both, of the user of that device for the purpose of providing a signal regarding the user's age bracket to applications available in a covered application store and to provide a developer, as defined, who has requested a signal with respect to a particular user with a digital signal via a reasonably consistent real-time application programming interface regarding whether a user is in any of several age brackets, as prescribed. The bill would require a developer to request a signal with respect to a particular user from an operating system provider or a covered application store when the application is downloaded and launched. This bill would prohibit an operating system provider or a covered application store from using data collected from a third party in an anticompetitive manner, as specified. This bill would punish noncompliance with a civil penalty to be enforced by the Attorney General, as prescribed. This bill would declare its provisions to be severable.
Existing law authorizes a court to issue a restraining order to a person to prevent abuse, as specified, based on reasonable proof of a past act or acts of abuse. Existing law authorizes the order to be issued solely on the affidavit or testimony of the person requesting the restraining order. Existing law requires a manufacturer of a connected device to equip the device with a reasonable security feature or features that are appropriate to the nature and function of the device, appropriate to the information it may collect, contain, or transmit, and designed to protect the device and information contained in the device from unauthorized access, destruction, use, modification, or disclosure. This bill would authorize a survivor, as defined, or a designated representative of a survivor, to submit a device protection request to an account manager, as defined, seeking to terminate a perpetrator's access to a connected device or associated user account. The bill would define "survivor" for these purposes to mean an individual who has had specified criminal acts committed or allegedly committed against them or who cares for another individual against whom those criminal acts have been committed or allegedly committed, as provided. The bill would require an account manager, within 2 business days of receiving a complete device protection request, to terminate or disable the perpetrator's access to the connected device or user account, or to inform the survivor, in a clear and conspicuous manner, of any methods to reset the device to factory settings or a similar state that removes all account holders, as provided. The bill would specify the requirements for a device protection request and would impose certain requirements on an account manager in processing a request. By providing that a device protection request may include a copy of a signed affidavit, the bill would expand the crime of perjury, and thus impose a state-mandated local program. This bill would require the account manager to clearly describe the process to submit a device protection request on their internet website or mobile application and would prohibit the account manager from providing specified information to the perpetrator. The bill would require an account manager and any officer, director, employee, vendor, or agent thereof to treat any information submitted by a survivor or a designated representative of a survivor as confidential and securely dispose of the information, as provided. This bill would authorize enforcement of these provisions by injunction or civil penalty in any court action by any person injured by a violation of those provisions, the Attorney General, a district attorney, county counsel, a city attorney, or a city prosecutor, against an account manager or perpetrator, as provided. The bill would prohibit a waiver of these prohibitions and would declare that these provisions are severable. Existing law authorizes a court to issue an ex parte order for, among other things, disturbing the peace of the other party. Existing law provides that disturbing the peace of the other party may be committed directly or indirectly, including through the use of a third party, and by any method or through any means including, but not limited to, telephone, online accounts, text messages, internet-connected devices, or other electronic technologies. This bill would provide that, for purposes of those provisions, an internet-connected device includes a connected device as described in the bill. The California Constitution requires the state to reimburse local agencies and school districts for certain costs mandated by the state. Statutory provisions establish procedures for making that reimbursement. This bill would provide that no reimbursement is required by this act for a specified reason.
Existing law establishes the Medi-Cal program, which is administered by the State Department of Health Care Services and under which qualified low-income individuals receive health care services. The Medi-Cal program is, in part, governed and funded by federal Medicaid program provisions. Existing law generally imposes penalties on a person who negligently, willfully, or maliciously discloses the results of a human immunodeficiency virus (HIV) test to a third party in a manner that identifies or provides identifying characteristics of the person to whom the test results apply, as specified. Existing law, notwithstanding the above-described restrictions, authorizes the recording of the HIV test results by the physician who ordered the test in the test subject's medical record and authorizes other disclosure of the results without written authorization of the test subject, or the subject's representative, to the test subject's providers of health care, excluding a regulated health care service plan, for purposes of diagnosis, care, or treatment of the patient. This bill would authorize a provider of health care to disclose the results of an HIV test that identifies or provides identifying characteristics of a Medi-Cal beneficiary without written authorization of the test subject, or the subject's representative, to the Medi-Cal managed care plan to which the beneficiary is assigned, if applicable, and to external quality review organizations conducting external quality reviews of Medi-Cal managed care plans, for the purpose of administering quality improvement programs, including, but not limited to, value-based payment programs and healthy behavior incentive programs, designed to improve HIV care for Medi-Cal beneficiaries. Under the bill, HIV test results that do not identify or provide identifying characteristics of the test subjects would be authorized for disclosure without written authorization by the Medi-Cal managed care plan to departmental staff for the above-described purpose. The bill would make certain clarifying or declaratory statements with regard to related provisions.
Existing law provides that everyone is responsible not only for the result of their willful acts, but also for an injury occasioned to another by their want of ordinary care or skill in the management of their property or person. Existing law requires the developer of a generative artificial intelligence system or service that is released on or after January 1, 2022, and made publicly available to Californians for use, to post on the developer's internet website documentation regarding the data used by the developer to train the generative artificial intelligence system or service. Existing law defines "artificial intelligence" for these purposes. This bill would prohibit a defendant who developed, modified, or used artificial intelligence, as defined, from asserting a defense that the artificial intelligence autonomously caused the harm to the plaintiff.
Existing law requires a social media platform to take various steps to prevent cyberbullying of minors on the platform, including by requiring the platform to establish a prominent mechanism within its internet-based service that allows any individual, whether or not that individual has a profile on the internet-based service, to report cyberbullying or any content that violates the existing terms of service related to cyberbullying. Existing law authorizes the State Department of Public Health to establish the Office of Suicide Prevention in the department, as prescribed. This bill would, among other things related to making a companion chatbot platform safer for users, if a reasonable person interacting with a companion chatbot would be misled to believe that the person is interacting with a human, require an operator of a companion chatbot platform to issue a clear and conspicuous notification indicating that the companion chatbot is artificially generated and not human. The bill would also require an operator to take certain actions with respect to a user the operator knows is a minor, including disclose to the user that the user is interacting with artificial intelligence. The bill would also require an operator to prevent a companion chatbot on its companion chatbot platform from engaging with users unless the operator maintains a protocol for preventing the production of suicidal ideation, suicide, or self-harm content to the user, as specified, and would require an operator to publish details on that protocol on the operator's internet website. This bill would, beginning July 1, 2027, require an operator to annually report to the Office of Suicide Prevention certain things, including protocols put in place to detect, remove, and respond to instances of suicidal ideation by users, and would require the office to post data from that report on its internet website. The bill would authorize a person who suffers injury in fact as a result of noncompliance with the bill to bring a certain civil action.
Existing law grants to a depicted individual a cause of action against a person who creates and intentionally discloses sexually explicit material if the person knows, or reasonably should have known, that the depicted individual in that material did not consent to its creation or disclosure or who intentionally discloses sexually explicit material that the person did not create if the person knows the depicted individual in that material did not consent to the creation of the sexually explicit material. Existing law defines "sexually explicit material" for purposes of that provision to mean any portion of an audiovisual work that shows the depicted individual performing in the nude or appearing to engage in, or being subjected to, sexual conduct and defines "depicted individual" to mean an individual who appears, as a result of digitization, to be giving a performance the individual did not actually perform or to be performing in an altered depiction. Existing law authorizes a plaintiff to recover, among other relief, statutory damages of not less than $1,500 but not more than $30,000, or $150,000 for a malicious violation, as prescribed. This bill would revise and recast the provision described above to additionally grant to a depicted individual a cause of action against a person who knows, or reasonably should know, that the depicted individual was a minor when the digitized sexually explicit material was created and would additionally grant a cause of action to that depicted individual against a person who knowingly facilitates or recklessly aids or abets conduct prohibited by that provision. The bill would define "digitized sexually explicit material" to mean any portion of a visual or audiovisual work created or substantially altered through digitization, including an image, that shows the depicted individual in the nude or appearing to engage in, or being subjected to, sexual conduct. This bill would make a person that provides a service that enables the ongoing operation of a deepfake pornography service presumed to be engaged in knowing facilitation or reckless aiding or abetting, as described above, if a depicted individual or public prosecutor provides the person with evidence sufficient to demonstrate that the person is providing services that enable the ongoing operation of a deepfake pornography service that engages in conduct described in the provisions described above, and the person fails to take all necessary steps to stop providing services that enable the ongoing operation of a deepfake pornography service within 30 days of receiving that evidence, as specified. This bill would increase the maximum statutory damages available to a depicted individual to $50,000 if the violation was not malicious and $250,000 for a malicious violation and would authorize certain public attorneys to bring a civil action to enforce these provisions, as specified.
Existing law generally regulates social media platforms, including, among other laws, the Protecting Our Kids from Social Media Addiction Act that prohibits an operator of an addictive internet-based service or application, including a social media platform, from providing an addictive feed, as defined, to a minor user, except as prescribed. This bill would enact the Social Media Warning Law that would require a covered platform, as defined, to display a certain black box warning to certain users each day the user initially accesses the social media platform, again after 3 hours of cumulative active use, and thereafter at least once per hour of cumulative active use, as prescribed. This bill would specify that its provisions shall not be interpreted to serve as the basis for a private right of action, as specified. The bill would make its provisions operative on January 1, 2027, and would declare these provisions severable.
The California AI Transparency Act requires a person that creates, codes, or otherwise produces a generative artificial intelligence system that has over 1,000,000 monthly visitors or users and is publicly accessible within the geographic boundaries of the state to make available an AI detection tool at no cost to the user that, among other things, allows a user to assess whether image, video, or audio content, or content that is a combination thereof, was created or altered by that person's generative artificial intelligence system and outputs any system provenance data that is detected in the content. Existing law makes the California AI Transparency Act operative on January 1, 2026. This bill would delay the operation of the California AI Transparency Act until August 2, 2026. This bill would, beginning January 1, 2027, additionally require a large online platform, as defined, to, among other things related to the provenance of content on the platform, detect whether any provenance data that is compliant with widely adopted specifications adopted by an established standards-setting body is embedded into or attached to content distributed on the large online platform. The bill would also require, beginning January 1, 2028, a capture device manufacturer, with respect to any capture device the capture device manufacturer first produced for sale in the state on or after January 1, 2028, to, among other things, provide a user with the option to include a latent disclosure in content captured by the capture device that conveys certain information, including the name of the capture device manufacturer. The bill would define "capture device" to mean a device that can record photographs, audio, or video content, including, but not limited to, video and still photography cameras, mobile phones with built-in cameras or microphones, and voice recorders. Existing law requires a covered provider to include a latent disclosure in AI-generated image, video, or audio content, or content that is any combination thereof, created by the covered provider's GenAI system that, among other things, conveys certain information and is permanent or extraordinarily difficult to remove, to the extent it is technically feasible. This bill would, beginning January 1, 2027, prohibit a GenAI system hosting platform, as defined, from knowingly making available a GenAI system that does not place disclosures, pursuant to those provisions. This bill would declare that its provisions are severable.
