Data Privacy Hub

The California legislature ended its session a month ago in style, passing 9 privacy and AI-related bills to be signed or vetoed by Governor Gavin Newsom.

Now that the full 30-day period to sign the slate of bills is over, here are the bills that Governor Newsom signed and vetoed:
‍

Signed:

• AB 2013 Generative artificial intelligence: training data transparency

Requires developers of AI systems to provide clear and accessible documentation on their website regarding the data used to train the AI.

• SB 942 California AI Transparency Act

Requires covered generative AI providers to make AI detection tools easily accessible to the public, as well as to create and include disclosures for any AI-generated content.

• SB 1223/AB 1008 Neural Data & Personal Information on AI Systems

Amends the CCPA to add neural data as an element of sensitive personal information, defining it as “information that is generated by measuring the activity of a consumer’s central or peripheral nervous system, and that is not inferred from nonneural information.”

• AB 1824 CCPA Recognition of Opt-outs in Mergers

Amends the CCPA so that any entity merging with or acquiring another entity must respect and comply with all previous consumer opt-out requests.

‍
Vetoed:

• SB 1047 Safe and Secure Innovation for Frontier Artificial Intelligence Models Act

Regulates the largest AI models on the market, as defined as models trained with a quantity of computing power exceeding one hundred million dollars ($100,000,000) using the average market prices of cloud compute at the start of training. This virtually limits the bill to regulating Big Tech, as Apple, Google, Meta, and Microsoft have raced out to capture the AI market.

• AB 3048 Opt-out Preference Signal

Prohibits businesses from developing or maintaining internet browsers or mobile operating systems that lack the ability for an individual to send an opt-out preference signal to businesses.

• AB 1949 On Children’s Data

Requires a form of consent before a business can conduct any data collection, data use, or sale or sharing of personal information of minors under age 18. Children aged 13-to-18 will be able to give consent, while those under 13 will require consent from a parent or guardian.

*****

The bills signed into law will take effect between January 1 2025 and January 1 2026, while the vetoed bills will need to start from scratch when the state legislature reopens in 2026.