Existing law, the Protecting Our Kids from Social Media Addiction Act, prohibits an operator of an addictive internet-based service or application from providing an addictive feed, as defined, to a user unless the operator does not have actual knowledge that the user is a minor, as specified, or the operator has obtained verifiable parental consent to provide an addictive feed to the user who is a minor. Existing law, the Digital Age Assurance Act, beginning January 1, 2027, requires a person who owns, maintains, or controls a software application, as defined, to request age bracket data sent by a real-time secure application programming interface or operating system with respect to a particular user from an operating system provider or a covered application store when the application is downloaded and launched. This bill would prohibit a covered platform, as defined, from providing an addictive feature, as defined, to a user who is under 16 years of age and would require a covered platform to implement reasonable measures to ensure that users under 16 years of age are not offered or provided any addictive feature on the covered platform. The bill would also authorize the Attorney General to adopt regulations to implement and enforce the bill in order to further the purpose of protecting minors online, including by altering the scope of "covered platform" if the Attorney General determines that doing so is necessary to ensure that "covered platform" applies to internet websites, online services, online applications, or mobile applications that make addictive features, as defined, available to users under 16 years of age. This bill would impose a civil penalty upon a noncompliant platform and would require its provisions to be enforced by a civil action brought only by the Attorney General or a local public prosecutor, as specified. This bill would also establish the e-Safety Advisory Commission within the Department of Justice as an independent advisory body that is only for administrative purposes to advise state government on certain matters related to online safety and would require the commission to, on or before January 1 of each year, report to the Legislature and the Governor on, among other things, its activities under the bill.
Existing law requires the Department of Technology to conduct, in coordination with other interagency bodies as it deems appropriate, a comprehensive inventory of all high-risk automated decision systems (ADS) that have been proposed for use, development, or procurement by, or are being used, developed, or procured by, any state agency. Existing law establishes the Labor and Workforce Development Agency, which is composed of various departments responsible for protecting and promoting the rights and interests of workers in California, including the Division of Labor Standards Enforcement, led by the Labor Commissioner, within the Department of Industrial Relations. This bill, beginning on July 1, 2027, would prohibit an employer, as defined, from using an ADS to perform certain functions and would limit the purposes for and way in which an ADS may be used. The bill would, when an employer primarily uses an ADS to make a disciplinary or termination decision, authorize an employee to request, and require an employer to provide, a description of the employee's own data primarily used by an ADS to make a disciplinary or termination decision, as specified. The bill would require an employer that primarily relied upon an ADS to make a disciplinary or termination decision to provide the affected employee with a written postuse notice, as specified. This bill would prohibit an employer from discharging, threatening to discharge, demoting, suspending, or in any manner discriminating or retaliating against any employee for taking certain actions asserting their rights under the bill. The bill would authorize the Labor Commissioner to enforce the bill's provisions and also authorize a public prosecutor to bring a civil enforcement action, as specified. The bill would set forth specified types of relief that a plaintiff may seek and specified penalties that an employer that violates these provisions is subject to, including a $500 civil penalty per violation. This bill would also provide that an employer who complies with the requirements related to notice in this bill is not required to comply with any substantially similar provisions under any other state law, except as specified. The bill would not apply to parties covered by a valid collective bargaining agreement if the agreement contains specified information, including an explicit waiver of the bill's provisions. The bill would provide that it does not prohibit the use of an automated decision system relating to the development of aircraft for use in the national airspace or the development of products or services for national security, military, space, or defense purposes, if the use of an automated decision system is reasonably necessary to comply with the federal statute, the federal regulation, or the binding federal contract, as specified. The bill would include a statement that changes proposed by this bill address a matter of statewide concern rather than a municipal affair and, therefore, apply to all cities, including charter cities. This bill would declare that its provisions are severable.
Existing law prohibits the intentional use of an electronic amplifying or recording device to eavesdrop upon or record a confidential communication, as specified, without the consent of all parties to the communication. Existing law additionally prohibits tapping a communication wire or intercepting or recording a telephone communication, as specified, without the consent of all parties, and prohibits trespassing on property for the purpose of committing, or attempting to commit, a violation of those prohibitions. A violation of those provisions is punishable by a fine not exceeding $2,500, by imprisonment as either a misdemeanor or a felony, or by both the fine and imprisonment, unless otherwise exempted. If that person has previously been convicted of a violation of any of the above-described laws, except for the prohibition on trespassing, a violation of any of those provisions is punishable by a fine not exceeding $10,000, by imprisonment as either a misdemeanor or a felony, or by both the fine and imprisonment. This bill would additionally prohibit a person from operating a wearable recording device, as defined, to capture sound or video of any other person in any area within a place of business, as defined, where the person has a reasonable expectation of privacy unless the person operating the device has the explicit consent of that person to capture sound or video of that person. The bill would prohibit a person from disabling any light, sound, or other indicator on a wearable recording device that indicates that the device is capturing sound or video. The bill would exempt from these provisions the use of hearing aids, augmentative and alternative communication devices, and similar devices by persons with impaired hearing or communication disorders when used for the purpose of overcoming the impairment or disorder to permit the hearing of sounds ordinarily audible to the human ear or to support communication with the person or by persons with a disability if the device or technology is used for the purpose of enabling a person's access to, or participation in, activities of daily living or to support a person's functional needs related to the disability or condition. The bill would make a violation of these provisions punishable by a fine not exceeding $1,500, by imprisonment as a misdemeanor, or by both that fine and imprisonment. The bill would make the exemptions from the provisions described above applicable to violations of these prohibitions. By creating new crimes, the bill would impose a state-mandated local program. The bill would, commencing on January 1, 2028, prohibit a person or entity from manufacturing, selling, delivering, holding, or offering for sale in commerce a wearable recording device without a light, sound, or other indicator that is sufficiently prominent so that a reasonable person in the vicinity would be alerted to the capturing activity. The bill would prohibit a person or entity from manufacturing, selling, delivering, holding, or offering for sale in commerce any technology that is designed for the primary purpose of, primarily marketed for, or likely primarily used for enabling a person to disable any light, sound, or other indicator on a wearable recording device that indicates that the device is capturing sound or video and would prohibit a person from purchasing, trading for, otherwise acquiring, or using that technology, as specified. The bill would make a knowing violation of these provisions punishable by a civil penalty not exceeding $2,500 per violation. The California Constitution requires the state to reimburse local agencies and school districts for certain costs mandated by the state. Statutory provisions establish procedures for making that reimbursement. This bill would provide that no reimbursement is required by this act for a specified reason.
(1) Existing law authorizes the operation of an autonomous vehicle on public roads for testing purposes by a driver who possesses the proper class of license for the type of vehicle operated if specified requirements are satisfied. Existing law prohibits the operation of an autonomous vehicle on public roads until the manufacturer submits an application to the Department of Motor Vehicles (department) , as specified, and that application is approved. Existing law requires the department to adopt regulations setting forth requirements for the submission and approval of an application, including, among other things, any testing, equipment, and performance standards the department concludes are necessary to ensure the safe operation of autonomous vehicles on public roads, as specified. Existing law requires manufacturers of autonomous vehicles that operate without a human operator physically present in the vehicle, except as provided, to comply with certain requirements, including, among other things, to maintain a dedicated emergency response telephone line that is available for emergency response officials and to equip each autonomous vehicle with a 2-way voice communication device that enables emergency response officials who are near the vehicle to communicate effectively with a remote human operator, as specified. Under existing law, an "emergency response official" includes, but is not limited to, emergency dispatchers, peace officers, as specified, and first responders. This bill would require manufacturers of autonomous vehicles to maintain communications capacity sufficient to support the maximum number of concurrent remote assistance or teleoperations sessions, as specified. The bill would require remote drivers to be located within the United States and hold a driver's license that is valid for operation in California, is of the appropriate class, and includes any required endorsements. The bill would require an autonomous vehicle manufacturer to ensure, through its staffing and assignments, that local incident technicians are immediately dispatched upon notification, electronically or otherwise, of a crash or other incident or upon receiving a request from an emergency response official or 911 dispatch center. The bill would, in the event of a fleetwide emergency or system failure that may create a traffic hazard or impeded emergency response, require an autonomous vehicle manufacturer to immediately notify affected local jurisdictions, including emergency dispatch, of the location and status of their fleet and deploy local incident technicians, where appropriate, whenever affected vehicles cannot be remotely recovered. The bill would require the department, on or before July 1, 2028, to adopt guidelines establishing reasonable response times for local incident technicians to be present at the scene upon the request of an emergency response official or 911 dispatch center. The bill would expand the definition of "emergency response official" for these purposes to also include traffic control, traffic enforcement, and parking enforcement personnel from a public agency in an applicable jurisdiction. The bill would require autonomous vehicle manufacturers, for an autonomous vehicle that operates as a commercial vehicle and that is not equipped with manual controls for completing the dynamic driving task, to ensure that remote assistants or remote drivers have the ability to place the autonomous vehicle in neutral to allow an emergency response official to move the vehicle, cause the autonomous vehicle to move as directed by an emergency response official, or turn off the vehicle and have it remain stationary until otherwise directed by an emergency response official. The bill would require autonomous vehicle manufacturers to maintain data on response times of local incident technicians and responses to fleetwide emergencies or system failures, emergency events, immobilizations, obstructions, crashes, and requests from emergency response officials. The bill would require autonomous vehicle manufacturers to provide this data to the department quarterly and would require the department to publish summary statistics on its internet website, as specified. The bill would authorize the department to share records with the Public Utilities Commission to support regulatory oversight of autonomous vehicle passenger service operations. The bill would specify that a violation of the above provisions is not a crime. The bill would authorize a city attorney or county counsel to bring a civil action on behalf of a city, county, or city and county to enforce specified violations of the above provisions. The bill would authorize a court to impose specified civil penalties payable to the jurisdiction bringing the action, as specified. (2) Existing law establishes the Commission on Peace Officer Standards and Training (POST) within the Department of Justice and requires the commission to develop guidelines and implement courses of instruction regarding specified topics, including, among others, racial profiling, handling domestic violence, and human trafficking. This bill would require POST to develop uniform guidelines and requirements for, and to provide approval of, the training and written guidance required to be provided by autonomous vehicle manufacturers. The bill would authorize POST to impose fees sufficient to cover the reasonable regulatory costs associated with administering these provisions. The bill would require POST to implement a course or courses of instruction for voluntary training of law enforcement officers, as defined, on autonomous vehicles that operate as commercial vehicles as it relates to public safety and to develop related uniform minimum guidelines for voluntary use by California law enforcement agencies, as specified. The bill would require the course or courses, learning and performance objectives, training standards, and guidelines to be developed in consultation with appropriate groups and individuals that have an interest and expertise in the field of the operation of autonomous vehicles, as specified. (3) The bill would make its provisions operative July 1, 2028.
The California Consumer Privacy Act of 2018 (CCPA) grants a consumer various rights with respect to personal information, as defined, that is collected or sold by a business, as defined, including the right to direct a business that collects sensitive personal information, as defined, about the consumer to limit its use, as prescribed. The California Privacy Rights Act of 2020, approved by the voters as Proposition 24 at the November 3, 2020, statewide general election, amended, added to, and reenacted the CCPA. This bill would, under the CCPA, prohibit a business, service provider, or contractor from selling or sharing sensitive personal information to a third party, except as specified. This bill would declare that its provisions further the purposes and intent of the California Privacy Rights Act of 2020.
Existing law prohibits a person from using a bot, as defined, to mislead another person about the bot's artificial identity to incentivize the purchase or sale of goods or services, among other things. Existing law requires an operator of a companion chatbot, as defined, to provide a disclosure regarding the companion chatbot's artificial identity if a reasonable person interacting with the companion chatbot would be misled to believe that the person is interacting with a human. This bill would prohibit a large private business, as defined, from representing that a customer service chatbot is a human. The bill would also require the large private business to provide certain disclosures if a reasonable person interacting with the chatbot would be misled to believe they are interacting with a human. This bill would require a large private business to provide a customer service feature allowing customers to contact a customer service agent during its regular business hours, as defined. This bill would require, except as specified, large private businesses to make a good faith effort to connect a customer to an agent within 15 minutes after a request for human customer service is made, or schedule an appointment with the customer, as specified. For online chatbot customer service platforms and telephonic customer service platforms, the bill would require a large private business to make a good faith effort to limit initial and cumulative telephonic hold times, and would require certain large private businesses to post prescribed contact information on their internet website. The bill would authorize a public prosecutor to enforce these provisions, and would make a large private business that violates these provisions liable for a penalty of up to $5,000 for an initial violation, and $10,000 for each subsequent violation. The bill would waive its requirements due to unforeseen circumstances beyond the reasonable control of a large private business or extraordinary or emergency situations, and would exempt a large private business that provides services subject to, and is in compliance with, specified public utilities law. The bill would further exempt exclusive business lines and communications by a hospital, as specified, and a consumer reporting agency, as prescribed. The bill would define terms for these purposes.
Existing law establishes various healing arts boards within the Department of Consumer Affairs that license and regulate various healing arts licensees. Existing laws, including the Licensed Marriage and Family Therapist Act, the Educational Psychologist Practice Act, the Clinical Social Worker Practice Act, and the Licensed Professional Clinical Counselor Act, make a violation of those acts a crime. Existing law regulates the use of artificial intelligence, as defined. Existing law requires a health facility, clinic, physician's office, or office of a group practice that uses generative artificial intelligence to generate written or verbal patient communications pertaining to patient clinical information to ensure those communications include a disclaimer that indicates to the patient that a communication was generated by artificial intelligence and instructions describing how a patient may contact a human health care provider, employee, or other appropriate person. This bill would regulate the use of artificial intelligence in connection with providing or facilitating psychotherapy services, as defined. The bill, among other things, would authorize an individual, corporation, or entity that provides or facilitates psychotherapy services to use artificial intelligence tools or systems only to assist in providing administrative or supplementary support in psychotherapy services, as specified. The bill would prohibit an individual, corporation, or entity from using artificial intelligence to record or transcribe psychotherapeutic communications or sessions or to triage or screen a person for the need for psychotherapy services unless the patient or client or their authorized representative is informed that artificial intelligence will be used and the purpose of the artificial intelligence tool or system, and the patient or client or their authorized representative provides consent, as specified. The bill would prohibit an individual, corporation, or entity from advertising or otherwise purporting to offer psychotherapy services when the services are provided through the use of companion chatbots. The bill would prohibit an individual, corporation, or entity from allowing artificial intelligence to perform certain acts, including making therapeutic decisions or detecting emotions or mental states, as specified, without review and approval by a licensed professional. The bill would make a violation of the bill's provisions subject to the jurisdiction of the appropriate health care professional licensing board or enforcement agency, as specified, and would authorize those boards and enforcement entities to pursue any remedies authorized by law. Existing law, the Confidentiality of Medical Information Act, generally restricts the persons and entities to whom, and the purposes for which, a health care provider, health care service plan, or contractor may release a patient's medical information. The Confidentiality of Medical Information Act additionally imposes certain disclosure requirements for the release of medical information that specifically relates to the patient's participation in outpatient treatment with a psychotherapist. In this regard, the act prohibits a health care provider, health care service plan, or contractor from releasing that information to persons or entities who have requested that information and who are otherwise authorized by specified laws to receive that information, unless the requester makes certain written disclosures to the patient and to the provider of health care, health care service plan, or contractor, as specified. Those disclosures include, among other things, the specific intended uses of the information, and the length of time during which the information will be kept before being destroyed or disposed of, as specified. Existing law makes a violation of those provisions that result in economic loss or personal injury to a patient punishable as a misdemeanor. This bill would require the use of artificial intelligence in patient or client records for psychotherapy services to comply with the confidentiality requirements of the above-described provision of the Confidentiality of Medical Information Act and would prohibit a company or entity from sharing, selling, storing, or training their models on any data obtained from psychotherapy in a manner inconsistent with any applicable law. By expanding the scope of existing crimes, the bill would impose a state-mandated local program. The California Constitution requires the state to reimburse local agencies and school districts for certain costs mandated by the state. Statutory provisions establish procedures for making that reimbursement. This bill would provide that no reimbursement is required by this act for a specified reason.
Existing law, the K–12 Pupil Online Personal Information Protection Act (KOPIPA) , generally protects the personal information of a student enrolled in a K–12 course of instruction, defined as a "pupil," by prescribing requirements and prohibitions applicable to an operator of an internet website, online service, online application, or mobile application with actual knowledge that the site, service, or application is used primarily for K–12 school purposes and was designed and marketed for K–12 school purposes. Existing law, the Early Learning Personal Information Protection Act (ELPIPA) , generally protects the personal information of a child enrolled in a preschool or prekindergarten course of instruction, defined as a "pupil," by prescribing requirements and prohibitions applicable to an operator of an internet website, online service, online application, or mobile application with actual knowledge that the site, service, or application is used primarily for preschool or prekindergarten purposes and was designed and marketed for preschool and prekindergarten purposes. This bill would instead apply the provisions of KOPIPA and ELPIPA to an operator, or an entity working on behalf of the operator, of an internet website, online service, online application, or mobile application with actual knowledge that the site, service, or application is used for the applicable school purposes and was designed or marketed for those purposes, as specified. The bill would, among other changes to KOPIPA and ELPIPA related to protecting the personal information of students, prohibit an operator from using covered information, as defined, including persistent unique identifiers, created or gathered by the operator's site, service, or application to train a generative artificial intelligence system or service or develop an artificial intelligence system. This bill would also enact the Higher Education Student Information Protection Act (HESIPA) , which would generally protect the personal information of a student enrolled in a higher education institution, as defined, in a similar manner as KOPIPA and ELPIPA. The bill would make HESIPA operative on July 1, 2027. This bill would authorize a pupil or student actually harmed by noncompliance with KOPIPA, ELPIPA, or HESIPA to bring a civil action against the noncompliant operator, as prescribed, and would require a person bringing that action to furnish a copy of the complaint to the Attorney General within 10 days after filing the action.
Existing law requires that if a reasonable person interacting with a companion chatbot, as defined, would be misled to believe that the person is interacting with a human, an operator of a companion chatbot platform must issue a clear and conspicuous notification indicating that the companion chatbot is artificially generated and not human. Existing law requires a chatbot operator to maintain a protocol for preventing the production of suicidal ideation, suicide, or self-harm content to the user, as specified, and would require an operator to publish details on that protocol on the operator's internet website. Existing law requires an operator to take certain actions with respect to a user the operator knows is a minor, including instituting reasonable measures to prevent the companion chatbot from producing sexually explicit visual material or proposing sexually explicit conduct. This bill would instead require a companion chatbot operator to take the above actions when it has constructive knowledge that a user is a minor. This bill would instead require an operator to prevent its companion chatbot from producing or facilitating the exchange of any sexually explicit material or proposing sexually explicit conduct.
Existing law requires, on or before September 1, 2024, the Department of Technology, within the Government Operations Agency, to conduct, in coordination with other interagency bodies as it deems appropriate, a comprehensive inventory of all high-risk automated decision systems that have been proposed for use, development, or procurement by, or are being used, developed, or procured by, any state agency. Existing law requires the department to annually submit a report of that comprehensive inventory to the Assembly Committee on Privacy and Consumer Protection and the Senate Committee on Governmental Organization. Existing law, the Transparency in Frontier Artificial Intelligence Act, among other things related to ensuring the safety of certain artificial intelligence models, requires a large frontier developer to write, implement, and clearly and conspicuously publish on its internet website a frontier AI framework that applies to the large frontier developer's frontier models and describes how the large frontier developer approaches, among other things, incorporating national standards, international standards, and industry-consensus best practices into its frontier AI framework. This bill would require, on or before January 1, 2028, the Government Operations Agency to take certain actions related to the selection and regulation of certain entities, defined as "independent verification organizations," designated by the agency as having demonstrated expertise in assessing the risks posed by an AI system or model and identifying the metrics and methodologies that form the basis for that assessment. The bill would require the agency to convene working groups to solicit stakeholder input in the identification of standards and the development and revision of procedures and criteria, as specified. The bill would require the agency to provide a report to the Legislature on the findings of the working groups and would require a designated IVO to submit annually, and no sooner than 12 months after initial designation as an IVO, to the agency and Legislature a report, as specified.
