Data Privacy Hub

The California state legislature concluded its 2024 session on September 1st, and one of the priorities in the final days was working through a grouping of privacy and AI-centric bills on the docket.

In the end, six privacy bills and four AI bills passed and will be sent to Governor Newsom's desk for signature within the next 30 days.

The Privacy bills include:

• AB 3286 on monetary thresholds; California sets a $10 million funding limit for CCPA enforcement and transfers cost-of-living adjustments to the enforcement agency (this passed in July, but is relevant)
• AB 3048 on Opt-out preference signals; internet browsers must include opt-out preference signals for users
• AB 1949 on children's privacy; businesses must obtain consent from children 13-17 before collecting, selling, or sharing data, and obtain parental consent for kids under 13
• SB 1223 & AB 1008 on data and AI systems; these bills amend CCPA to include "neural data" as a category of sensitive personal information and updates the law's definition of "personal information" to note that it can take a variety of formats, including "artificial intelligence systems that are capable of outputting personal information.”
• AB 1824 on recognition of opt-outs in mergers & acquisitions; when any corporate merger or acquisition occurs, the acquiring entity must respect all previous user opt-outs and consent choices

The AI bills include:

• SB 1047 on the Safe and Secure Innovation for Frontier Artificial Intelligence Act; this puts further testing and transparency requirements on the biggest AI systems such as ChatGPT
• AB 2013 on generative AI training data transparency; AI developers must post documentation outlining the data used to train the system or service on their website
• AB 2885 on the definition of AI; this amends existing state laws to define and regulate AI as "an engineered or machine-based system that varies in its level of autonomy and that can, for explicit or implicit objectives, infer from the input it receives how to generate outputs that can influence physical or virtual environments.”
• SB 942 on AI transparency; this creates additional transparency obligations for any person or entity that produces a generative artificial intelligence system that attracts over one million monthly visitors/users and is publicly accessible within California.

How this grouping of bills will impact data privacy in California and the US remains to be seen, but lots is still happening and privacy professionals would benefit from staying on top of developments out of California. For more break down on these specific laws and their potential impact, see our blog.